Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSS
CVE-2021-24974

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Product Feed Pro For WooCommerce
Vendor
CVE Published:
24 January 2022

Summary

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.

Affected Version(s)

Product Feed PRO for WooCommerce 11.0.7

References

https://wpscan.com/vulnerability/8ed549fe-7d27-4a7a-b226-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.