VulnerabilityModified
CVE-2022-0426
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a…
MEDIUM 5.4EPSS 0.65%
Does this matter?
Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own.
Description
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- adtribes/product feed pro for woocommerce
- Source
- contact@wpscan.com
References
- https://plugins.trac.wordpress.org/changeset/2670405Patch, Third Party Advisory
- https://wpscan.com/vulnerability/de69bcd1-b0b1-4b16-9655-776ee57ad90aExploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2670405Patch, Third Party Advisory
- https://wpscan.com/vulnerability/de69bcd1-b0b1-4b16-9655-776ee57ad90aExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.