CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.
Explanation of Vulnerability in Simple Terms
Preview E-Mails for WooCommerce version 1.6.8 contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link that, when clicked by a site visitor, executes JavaScript in the victim's browser. The vulnerability affects the plugin's email preview functionality and can impact site visitors across the affected installation.
What an attacker can do
Inject and execute malicious JavaScript in a visitor's browser to steal session cookies, redirect users, or deface content.
Potential impact on your site
Visitors clicking attacker-controlled links may have their sessions hijacked or be redirected to malicious sites; your site's reputation could be damaged.
Conditions required to exploit
Attacker must trick a site visitor into clicking a malicious link; no authentication or special privileges required.
Key dates
External resources
Related vulnerabilities
