WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-39162

7.1HIGH

Key Information:

Vendor
WordPress
Status
User Email Verification For WooCommerce
Vendor
CVE Published:
4 September 2023

Summary

The XLPlugins User Email Verification for WooCommerce plugin has a reflected cross-site scripting (XSS) vulnerability that allows an unauthenticated user to inject malicious scripts via a crafted request. This vulnerability affects all versions of the plugin up to and including 3.5.0, potentially compromising the security of online stores using this plugin and enabling attackers to execute arbitrary scripts in the context of users' browsers.

Affected Version(s)

User Email Verification for WooCommerce <= 3.5.0

References

https://patchstack.com/database/vulnerability/woo-confirm...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.