WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-41874

7.1HIGH

Key Information:

Vendor
WordPress
Status
Order Delivery Date For WooCommerce
Vendor
CVE Published:
25 September 2023

Summary

A vulnerability exists in Tyche Software's Order Delivery Date for WooCommerce plugin versions 3.20.0 and below, allowing attackers to exploit an unauthenticated reflected Cross-Site Scripting (XSS) flaw. This can lead to the execution of arbitrary JavaScript code in the context of users' browsers, potentially compromising user sessions and data integrity. Website administrators using the affected plugin should update to the latest version to mitigate this risk.

Affected Version(s)

Order Delivery Date for WooCommerce <= 3.20.0

References

https://patchstack.com/database/vulnerability/order-deliv...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phd (Patchstack Alliance)
.