CVE-2023-46783 MEDIUM

CVE-2023-46783: WordPress Pre-Orders for WooCommerce Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS)

Vendor Bright Plugins
Product Pre-Orders for WooCommerce
Weakness CWE-79 · XSS
Published November 6, 2023
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bright Plugins Pre-Orders for WooCommerce plugin <= 1.2.13 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Pre-Orders for WooCommerce versions up to 1.2.13 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability requires user interaction to trigger and can affect multiple users across the site.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in other users' browsers, potentially stealing session tokens or admin credentials.

Potential impact on your site

04Site Impact

Attackers with basic user accounts can compromise admin sessions and take control of your WooCommerce store.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account (e.g., customer or subscriber) and a victim must view a page containing the injected payload.

Key dates

06Disclosure timeline

November 6, 2023 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57670 WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-9148 Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field CVE-2026-57351 WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57360 WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-57675 WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability