WordPress Plugin Vulnerabilities

Discounts Manager for Products < 3.4.5 - Reflected Cross-Site Scripting

Description

The plugin does not escape the wcdp_tab parameter before outputting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
woocommerce-discounts-plus
Fixed in 3.4.5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
d804f73f-6ff0-4175-ac9d-3537014462f8

Timeline

Publicly Published
2021-10-12 (about 4 years ago)
Added
2021-10-12 (about 4 years ago)
Last Updated
2021-10-12 (about 4 years ago)

Other

Published
Title
Published
2024-07-01
Title
Cost Calculator Builder < 3.2.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2021-09-21
Title
St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting
Published
2022-02-14
Title
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode
Published
2024-06-28
Title
Stock Ticker < 3.24.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode
Published
2014-08-01
Title
Crius - VideoJS Cross-Site Scripting