Stored Cross-Site Scripting in Booster for WooCommerce Plugin by WordPress
CVE-2023-4945

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Booster for WooCommerce
Vendor
CVE Published:
14 September 2023

Summary

The Booster for WooCommerce plugin for WordPress has a vulnerability that allows authenticated users with contributor-level permissions to execute arbitrary JavaScript via multiple shortcodes. This issue arises from inadequate sanitization of user input and improper output escaping of attributes. When exploited, this vulnerability can inject malicious scripts that run whenever users access the affected pages, potentially compromising user data and site integrity.

Affected Version(s)

Booster for WooCommerce * <= 7.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woocommerce-je...
https://plugins.trac.wordpress.org/changeset/2966325/wooc...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.