Lucene search
WpvulndbWPVDB-ID:25AD93FA-AA70-4CA4-B50A-4F0AEAC4E975HistoryDec 01, 2021 - 12:00 a.m.
Variation Swatches for WooCommerce < 2.1.2 - Subscriber+ Stored Cross-Site Scripting
2021-12-0100:00:00
wpscan.com
2
0.001 Low
EPSS
Percentile
19.4%
The plugin does not have authorisation and CSRF checks in the tawcvs_save_settings, update_attribute_type_setting and update_product_attr_type AJAX actions, allowing any authenticated users to call them. The tawcvs_save_settings could especially be used to update the plugin’s settings and add XSS payloads
| CPE | Name | Operator | Version |
|---|---|---|---|
| variation-swatches-for-woocommerce | lt | 2.1.2 |
Related
cve
cve
CVE-2021-42367
2021-12-14 16:15:09
nvd
nvd
CVE-2021-42367
2021-12-14 16:15:09
threatpost
threatpost
80K Retail WooCommerce Sites Exposed by Plugin XSS Bug
2021-12-01 19:34:53
wordfence
wordfence
XSS Vulnerability Patched in Plugin Designed to Enhance WooCommerce
2021-12-01 14:55:56
cnvd
cnvd
openvas
openvas
prion
prion
Cross site scripting
2021-12-14 16:15:00
cvelist
cvelist
patchstack
patchstack