Stored Cross-Site Scripting in TM WooCommerce Compare & Wishlist Plugin for WordPress
CVE-2023-5230
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 September 2023
What is CVE-2023-5230?
The TM WooCommerce Compare & Wishlist plugin for WordPress has a vulnerability that allows authenticated users with contributor-level permissions and higher to exploit stored cross-site scripting. This occurs through the 'tm_woo_wishlist_table' shortcode, which fails to adequately sanitize input and escape output for user-provided attributes. As a result, attackers can inject malicious scripts that execute on the pages viewed by users, posing significant security risks to WordPress sites.
Affected Version(s)
TM WooCommerce Compare & Wishlist * <= 1.1.7