WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page
CVE-2022-1673

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
WooCommerce Green Wallet Gateway
Vendor
CVE Published:
8 June 2022

What is CVE-2022-1673?

The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.

Affected Version(s)

WooCommerce Green Wallet Gateway 1.0.2

References

https://wpscan.com/vulnerability/14283389-a6b8-4dd8-9441-...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

goodguyandy
.