Unauthenticated Cross-Site Scripting Vulnerability in The Product Vendors

CVE-2017-20193

What is CVE-2017-20193?

A reflected cross-site scripting vulnerability exists in the WooCommerce Product Vendors plugin, specifically through the 'vendor_description' parameter. This flaw results from inadequate input sanitization and output escaping in versions up to 2.0.35. Unauthenticated attackers can exploit this vulnerability by injecting malicious web scripts, which may execute in a user's browser when they are tricked into clicking a specially crafted link. The exploitation of this vulnerability could potentially lead to session hijacking, defacement of web pages, or other malicious activities, threatening the integrity and security of affected user accounts.

References