WooCommerce Product Filter < 1.4.4 – Admin+ Stored XSS | CVE 2024-2278 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

As and admin, create a filter with the following payload as name: "><svg/onload=alert(/XSS/)>

The XSS will be triggered in the Product Filters table (ie /wp-admin/admin.php?page=wpf_search)

Affects Plugins

themify-wc-product-filter

Fixed in 1.4.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

2cbabde8-1e3e-4205-8a5c-b889447236a0

Timeline

Publicly Published

2024-03-11 (about 1 year ago)

Added

2024-03-11 (about 1 year ago)

Last Updated

2024-03-11 (about 1 year ago)

Other

Published

Title

Published

2020-04-13

Title

Media Library Assistant < 2.82 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2024-01-03

Title

Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG

Published

2024-06-04

Title

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor < 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget

Published

2023-03-20

Title

Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site Scripting

Published

2025-04-11

Title

Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.35 Reflected Cross-Site Scripting via 'image_id' Parameter