CVE-2022-4431

Exploit

EPSS 0.5%
Veröffentlicht 16.01.2023 16:15:11
Zuletzt bearbeitet 04.04.2025 21:15:42
Quelle contact@wpscan.com
CVE-Watchlists
Login
Unerledigt
Login

WOOCS < 1.3.9.4 - Contributor+ Stored XSS

WOOCS <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

WOOCS <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Mögliche Gegenmaßnahme

FOX – Currency Switcher Professional for WooCommerce: Update to version 1.3.9.3, or a newer patched version

FOX – Currency Switcher Professional for WooCommerce: Update to version 1.3.9.4, or a newer patched version

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

NVD 1 VulnDex Vulnerability Enrichment 2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Pluginus ≫ Fox - Currency Switcher Professional For Woocommerce SwPlatformwordpress Version < 1.3.9.4

Weitere Schwachstelleninformationen

SystemWordPress Plugin

≫

Produkt FOX – Currency Switcher Professional for WooCommerce

Version *-1.3.9.2

SystemWordPress Plugin

≫

Produkt FOX – Currency Switcher Professional for WooCommerce

Version *-1.3.9.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.5%	0.389

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N