7.2

CVE-2019-25152

Exploit

Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Mögliche Gegenmaßnahme
Abandoned Cart Lite for WooCommerce: Update to version 5.2.0, or a newer patched version
Abandoned Cart Pro for WooCommerce: Update to version 7.13.0, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Abandoned Cart Lite for WooCommerce
Version [*, 5.2.0)
SystemWordPress Plugin
≫
Produkt Abandoned Cart Pro for WooCommerce
Version * - 7.12.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tychesoftwares ≫ Abandoned Cart Lite For Woocommerce SwPlatformwordpress Version < 5.2.0
Tychesoftwares ≫ Abandoned Cart Pro For Woocommerce SwPlatformwordpress Version <= 7.12.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 30.62% 0.966
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@wordfence.com 7.2 3.9 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N