WordPress Plugin Vulnerabilities

Advanced Woo Search < 2.78 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not properly sanitize input and escape output in admin settings, leading to Stored Cross-Site Scripting vulnerabilities. This issue affects multi-site installations and those with unfiltered_html disabled.

Affects Plugins

Plugin icon
advanced-woo-search
Fixed in 2.78

References

CVE
CVE-2023-2452
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4278e9d7-aa1e-47a5-b715-09dae5156303?source=cve

Miscellaneous

Original Researcher
Ivan Kuzymchak
Verified
No
WPVDB ID
c63f4f09-79ec-492a-840e-80f3eac6917a

Timeline

Publicly Published
2023-05-01 (about 3 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2023-11-27
Title
Restricted Site Access <= 7.4.1 - IP Spoofing to Protection Mechanism Bypass
Published
2024-11-11
Title
Relais 2FA <= 1.0 - Authentication Bypass
Published
2014-08-01
Title
Awake 3.3 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2023-06-02
Title
Online Booking & Scheduling Calendar for WordPress by vcita < 4.5 - Subscriber+ Settings Update & Stored XSS
Published
2024-10-28
Title
Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Privilege Escalation