Cross-Site Scripting Vulnerability in WebAppick WooCommerce Product Feed Plugin

CVE-2019-1010124

What is CVE-2019-1010124?

The WebAppick WooCommerce Product Feed plugin versions prior to 2.2.18 contain a Cross-Site Scripting vulnerability that could allow authenticated administrators to manipulate theme files, potentially leading to remote code execution. This security flaw occurs in the script found in the admin/partials/woo-feed-manage-list.php file. Attackers must have administrator access to exploit this vulnerability, making it critical for WordPress site owners to ensure their plugins are up-to-date and review their administrative permissions.

References