CVE-2022-0234: WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting
First published: Mon Feb 21 2022(Updated: )
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pluginus Woocs | <1.3.7.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-0234.
What is the severity level of CVE-2022-0234?
The severity level of CVE-2022-0234 is medium (6.1).
What software is affected by CVE-2022-0234?
The WOOCS WordPress plugin before version 1.3.7.5 is affected by CVE-2022-0234.
What is the issue with the WOOCS WordPress plugin?
The WOOCS WordPress plugin does not properly sanitize and escape the woocs_in_order_currency parameter, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
How can I fix CVE-2022-0234?
To fix CVE-2022-0234, update the WOOCS WordPress plugin to version 1.3.7.5 or newer.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/pluginus
- canonical/pluginus woocs