CVE-2022-4629

CVE-2022-4629: Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode

Vendor Unknown
Product Product Slider for WooCommerce
Published January 23, 2023
Last update April 2, 2025

CVSS base score

What the vulnerability does

01Description

The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Key dates

02Disclosure timeline

January 23, 2023 CVE published
April 2, 2025 Record updated