Vulners
Lucene search
Wordpress WooCommerce Plugin 2.0.17 Cross-Site Scripting Vulnerability
🗓️ 18 Oct 2013 00:00:00Reported by Gjoko KrsticFigh hive to teppeiType 
zeroscience🔗 www.zeroscience.mk👁 21 Views
<html><body><p>Wordpress WooCommerce Plugin 2.0.17 Cross-Site Scripting Vulnerability
Vendor: WooThemes
Product web page: http://www.woothemes.com
Affected version: 2.0.17 and 2.0.14
Summary: WooCommerce is an open source e-commerce plugin for WordPress.
Desc: The plugin suffers from a XSS issue due to a failure to properly
sanitize user-supplied input to the 'hide-wc-extensions-message' parameter
in the 'admin/woocommerce-admin-settings.php' script. Attackers can exploit
this weakness to execute arbitrary HTML and script code in a user's browser
session.
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Figh hive teppei ;)
Advisory ID: ZSL-2013-5156
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5156.php
Vendor: https://github.com/woothemes/woocommerce/commit/4b581450480d74667b76d6ba50961d79a6d7a0c1
13.10.2013
--
http://localhost/wordpress/wp-admin/admin.php?page=woocommerce_settings&saved=true&%22%3E%3Cscript%3Ealert%28%27ZSL%20XSS%27%29;%3C/script%3E
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 Oct 2013 00:00Current
6.1Medium risk
Vulners AI Score6.1