Gm Woo Product List Widget Vulnerabilities

[en] The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).

Affected:

up to 1.0

Fixed in:

1.0

Disclosed:

Jan 2, 2023

CVE-2022-4329 on NVD →

The Product list Widget for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on the 'formid' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Dec 8, 2022

CVE-2022-4329 on NVD →