WordPress Plugin Vulnerabilities
WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS
Description
The plugin does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Proof of Concept
As and admin, create a filter with the following payload as name: "><svg/onload=alert(/XSS/)> The XSS will be triggered in the Product Filters table (ie /wp-admin/admin.php?page=wpf_search)
Affects Plugins
References
CVE
Classification
Type
XSS
OWASP top 10
CWE
Miscellaneous
Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2024-03-11 (about 2 months ago)
Added
2024-03-11 (about 2 months ago)
Last Updated
2024-03-11 (about 2 months ago)