CVE-2021-25062: Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-25062?
CVE-2021-25062 is a vulnerability found in the Orders Tracking for WooCommerce WordPress plugin before version 1.1.10 that allows for Reflected Cross-Site Scripting (XSS) attacks.
How does CVE-2021-25062 impact the affected software?
CVE-2021-25062 impacts the Orders Tracking for WooCommerce plugin by not properly sanitizing and escaping the file_url before displaying it on an admin page, which can lead to a Reflected Cross-Site Scripting vulnerability.
What is the severity of CVE-2021-25062?
CVE-2021-25062 has a severity rating of medium (6.1) according to the CVSS (Common Vulnerability Scoring System) scale.
How can I fix CVE-2021-25062?
To fix CVE-2021-25062, update the Orders Tracking for WooCommerce WordPress plugin to version 1.1.10 or later, which includes the necessary sanitization and escaping of the file_url.
Where can I find more information about CVE-2021-25062?
You can find more information about CVE-2021-25062 on the WordPress plugin's official changeset: https://plugins.trac.wordpress.org/changeset/2643807