CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin <= 2.1.48 versions.
Explanation of Vulnerability in Simple Terms
A stored cross-site scripting (XSS) vulnerability exists in PI Websolution's WooCommerce checkout and product display plugins. An authenticated admin or high-privilege user can inject malicious JavaScript through plugin settings. When other users view affected pages or interact with the plugin, the injected script executes in their browsers, potentially stealing session data or performing unauthorized actions.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view affected pages.
Potential impact on your site
Site visitors' browsers could execute attacker-controlled code, risking credential theft, malware distribution, or unauthorized account actions.
Conditions required to exploit
Attacker must have high-privilege access (admin or equivalent) to the WordPress site and the victim must visit an affected page.
Key dates
External resources
Related vulnerabilities
