WordPress Plugin Vulnerabilities
SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting
Description
The plugin is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.
Proof of Concept
Enter the payload below for the "SMS Alert Username" in the plugin's settings. "+onfocus="alert(1)"+autofocus=" You will observe that the JavaScript payload successfully got reflected is and we are getting a pop-up.
Affects Plugins
Fixed in version 3.4.7
References
Classification
Miscellaneous
Original Researcher
swapnil bodekar
Submitter
swapnil bodekar
Verified
No
Timeline
Publicly Published
2021-08-02 (about 1 years ago)
Added
2021-08-03 (about 1 years ago)
Last Updated
2022-02-24 (about 1 years ago)