Lucene search
WpvulndbWPVDB-ID:E6C8015D-1A06-4121-9EF6-D555F3432A2EHistoryMay 22, 2023 - 12:00 a.m.
WooCommerce Follow-Up Emails < 4.9.50 - Unauthenticated Reflected XSS
2023-05-2200:00:00
wpscan.com
2
woocommerce
follow-up emails
unauthenticated
reflected
cross-site scripting
high-privilege users
admin.
0.0005 Low
EPSS
Percentile
18.4%
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
| CPE | Name | Operator | Version |
|---|---|---|---|
| woocommerce-follow-up-emails | lt | 4.9.50 |
References
patchstack.com/database/vulnerability/woocommerce-follow-up-emails/wordpress-woocommerce-follow-up-emails-plugin-4-9-40-reflected-cross-site-scripting-xss-vulnerability
www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-follow-up-emails/woocommerce-follow-up-emails-4940-reflected-cross-site-scripting
Related
nvd
nvd
CVE-2023-33319
2023-05-28 19:15:09
cve
cve
CVE-2023-33319
2023-05-28 19:15:09
prion
prion
Cross site scripting
2023-05-28 19:15:00
cvelist
cvelist
wordfence
wordfence