WordPress Plugin Vulnerabilities

Stock Sync for WooCommerce < 2.4.1 - Reflected XSS

Description

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
stock-sync-for-woocommerce
Fixed in 2.4.1

References

CVE
CVE-2023-31094

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Ivy - TOOR, LISA
Verified
No
WPVDB ID
198d7a90-3f34-4f19-851b-ddeed3b68b43

Timeline

Publicly Published
2023-08-18 (about 2 years ago)
Added
2023-08-18 (about 2 years ago)
Last Updated
2023-08-21 (about 2 years ago)

Other

Published
Title
Published
2024-01-10
Title
EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting
Published
2025-03-11
Title
wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-05-06
Title
Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode
Published
2024-11-20
Title
Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-10-24
Title
Interactive World Map < 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting