WordPress Plugin Vulnerabilities

Order Tracking Pro < 3.3.7 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape the order status parameter, which could allow users with a role of Admin to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
order-tracking
Fixed in 3.3.7

References

CVE
CVE-2023-4500

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
da1d3ecc-bb2f-4cdf-8e23-5e12f4b75169

Timeline

Publicly Published
2023-08-28 (about 2 years ago)
Added
2023-08-31 (about 2 years ago)
Last Updated
2023-08-31 (about 2 years ago)

Other

Published
Title
Published
2023-12-05
Title
Bold Page Builder < 4.7.0 - Contributor+ Stored XSS
Published
2025-01-16
Title
melascrivi-plugin <= 1.4 - Reflected Cross-Site Scripting
Published
2024-01-03
Title
Posts to Page <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-05
Title
Next-Cart Store to WooCommerce Migration < 3.9.4 - Reflected Cross-Site Scripting
Published
2026-03-25
Title
Fluent Booking < 2.0.05 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters