CVE-2023-5348

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.53% chance of exploitation in the next 30 days, 43th percentile

Published

2023-12-18

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1

References

• CVE Record
• NVD entry

Related

• CVE-2023-5347
• CVE-2023-5350
• CVE-2023-5345
• CVE-2023-5351
• CVE-2023-5344
• CVE-2023-5352