Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module

The plugin does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue

PoC

The “General” module needs to be enabled in “Woocommerce -> Booster Settings -> Booster”. https://example.com/wp-admin/admin.php?page=wcj-tools&amp;tab;=custom_roles&amp;wcj;_delete_role=