CVE-2023-5348

Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.

Affected

Product Catalog Mode For WooCommerce

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2023-12-18

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1

References

• CVE Record
• NVD entry