Additional Order Filters for WooCommerce < 1.12 - Reflected XSS

2023-11-1600:00:00

wpscan.com

woocommerce

plugin

xss

vulnerability

php_self

attribute

admin page

security

EPSS

0.001

Percentile

17.0%

JSON

Description The plugin does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.

References

patchstack.com/database/vulnerability/additional-order-filters-for-woocommerce/wordpress-additional-order-filters-for-woocommerce-plugin-1-10-reflected-cross-site-scripting-xss-vulnerability

EPSS

0.001

Percentile

17.0%

JSON

Related for WPVDB-ID:F835A393-D678-4C98-82DF-75FC5685377A