Stored Cross-Site Scripting in WooCommerce Plugin by WordPress

CVE-2023-5638

Summary

The Booster for WooCommerce plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) attack through the 'wcj_image' shortcode. This vulnerability arises from inadequate input sanitization and output escaping for user-supplied attributes, allowing authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts are executed whenever users access affected pages, potentially compromising user data and site integrity. Users of this plugin should review their installations and apply updates to safeguard against this security risk.

References