Reflected Cross-Site Scripting Vulnerability in Woo Bulk Price Update Plugin by WordPress
CVE-2023-28665

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Woo Bulk Price Update WordPress Plugin
Vendor
CVE Published:
22 March 2023

What is CVE-2023-28665?

The Woo Bulk Price Update plugin for WordPress, specifically versions prior to 2.2.2, contains a reflected cross-site scripting vulnerability. This issue arises from improper handling of the 'page' parameter in the techno_get_products action, allowing an authenticated user to exploit the flaw. If successfully executed, an attacker could inject malicious scripts that may lead to unauthorized actions or data exfiltration within the affected WordPress site.

Affected Version(s)

Woo Bulk Price Update WordPress Plugin < 2.2.2

References

https://www.tenable.com/security/research/tra-2023-3

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.