WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Plugin Vulnerabilities

Booster for WooCommerce - Reflected Cross-Site Scripting

Description

The plugins do not escape some URLs and parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Affects Plugins

woocommerce-jetpack
Fixed in version 5.6.3
booster-plus-for-woocommerce
Fixed in version 6.0.0
booster-elite-for-woocommerce
Fixed in version 6.0.0

References

CVE
CVE-2022-4227

Classification

Type

XSS

OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher

WPScan

Verified

Yes

WPVDB ID
90d3022c-5d35-4ef2-ab87-6919268db890

Timeline

Publicly Published

2022-12-05 (about 1 months ago)

Added

2022-12-05 (about 1 months ago)

Last Updated

2022-12-05 (about 1 months ago)

Our Other Services

WPScan WordPress Security Plugin