Lucene search

Erwan LR (WPScan)WPVDB-ID:3CB1F707-6093-42A7-A778-2B296BDF1735

HistoryApr 03, 2024 - 12:00 a.m.

WooCommerce Customers Manager < 29.8 - Reflected XSS

2024-04-0300:00:00

Erwan LR (WPScan)

wpscan.com

woocommerce

customers manager

reflected xss

cross-site scripting

high privilege users

security vulnerability

plugin

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

PoC

Make a logged in admin open the HTML page/URLs below https://example.com/wp-admin/admin.php?page=woocommerce-customers-manager&action;=wccm-customer-metadata&customer;=">

CPENameOperatorVersion
eq29.8

CPE	Name	Operator	Version
		eq	29.8