CVE-2023-5348: Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update
Published Dec 18, 2023
·Updated
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
Affected Software
1 affected component
MultiVendorX Product Catalog Mode For Woocommerce Wordpress<5.0.3
Event History
Dec 18, 2023
CVE Published
08:07 PM
Data Sourced
08:07 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-5348?
CVE-2023-5348 has been classified as a high severity vulnerability due to the potential for stored XSS attacks by unauthenticated users.
2
How do I fix CVE-2023-5348?
To fix CVE-2023-5348, update the Product Catalog Mode For WooCommerce plugin to version 5.0.3 or later.
3
Who is affected by CVE-2023-5348?
CVE-2023-5348 affects all versions of the Product Catalog Mode For WooCommerce plugin prior to 5.0.3.
4
What type of vulnerability is CVE-2023-5348?
CVE-2023-5348 is a stored cross-site scripting (XSS) vulnerability.
5
What can attackers do with CVE-2023-5348?
Attackers exploiting CVE-2023-5348 can execute malicious scripts in the context of the victim user's session.