WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-45004

7.1HIGH

Key Information:

Vendor
WordPress
Status
Woo Custom Emails
Vendor
CVE Published:
17 October 2023

Summary

The Woo Custom Emails plugin developed by wp3sixty has a reflected Cross-Site Scripting (XSS) vulnerability, which affects versions 2.2 and below. This vulnerability allows an attacker to inject malicious scripts into web pages, exploiting the trust a user has in a legitimate website. By sending a specially crafted request, an unauthorized individual may execute arbitrary scripts in the context of another user’s browser, potentially leading to sensitive information disclosure and session hijacking.

Affected Version(s)

Woo Custom Emails <= 2.2

References

https://patchstack.com/database/vulnerability/woo-custom-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.