WordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-36686

7.1HIGH

Key Information:

Vendor

WordPress
Status
Cartflows Pro
Vendor
CVE Published:
5 August 2023

What is CVE-2023-36686?

The CartFlows Pro plugin for WordPress exhibits a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited through specific user inputs. This flaw, impacting versions 1.11.11 and lower, enables attackers to inject malicious scripts, potentially leading to unauthorized actions and security breaches. Website owners using affected versions should prioritize patching to mitigate risks associated with this security issue.

Affected Version(s)

CartFlows Pro <= 1.11.11

References

https://patchstack.com/database/vulnerability/cartflows-p...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.