CVE-2022-4629: Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4629?
CVE-2022-4629 has a severity rating that indicates it can lead to Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-4629?
To fix CVE-2022-4629, update the Product Slider for WooCommerce plugin to version 2.6.4 or later.
Who is affected by CVE-2022-4629?
Users of the Product Slider for WooCommerce WordPress plugin prior to version 2.6.4 are affected by CVE-2022-4629.
What type of vulnerability is CVE-2022-4629?
CVE-2022-4629 is a Stored Cross-Site Scripting (XSS) vulnerability that can be exploited by users with low-level roles.
Can contributors exploit CVE-2022-4629?
Yes, users with a role as low as contributor can exploit CVE-2022-4629 due to insufficient validation and escaping of shortcode attributes.