CVE-2022-0426: Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0426?
CVE-2022-0426 has a medium severity rating due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2022-0426?
To fix CVE-2022-0426, update the Product Feed PRO for WooCommerce plugin to version 11.2.3 or later.
Who is affected by CVE-2022-0426?
Any website using versions of the Product Feed PRO for WooCommerce plugin prior to 11.2.3 is affected by CVE-2022-0426.
What is reflected cross-site scripting in the context of CVE-2022-0426?
Reflected cross-site scripting in CVE-2022-0426 occurs when unescaped user input allows malicious scripts to be executed in the browser of any authenticated user.
Is user authentication required to exploit CVE-2022-0426?
Yes, an authenticated user can exploit CVE-2022-0426 due to the exposed woosea_categories_dropdown AJAX action.