Reflected XSS Vulnerability in Preview E-mails for WooCommerce
CVE-2024-27999

7.1HIGH

Key Information:

Vendor
WordPress
Status
Preview E-mails For WooCommerce
Vendor
CVE Published:
28 March 2024

Summary

The vulnerability presents an improper neutralization of user input during web page generation, specifically in the Preview E-mails for WooCommerce plugin developed by Digamber Pradhan. This issue allows for reflected cross-site scripting (XSS), which can lead to unauthorized access or manipulation of user sessions and expose critical user data. The affected versions include all prior to 2.2.1, posing a significant risk for websites utilizing this plugin.

Affected Version(s)

Preview E-mails for WooCommerce <= 2.2.1

References

https://patchstack.com/database/vulnerability/woo-preview...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.