CVE-2023-46822 HIGH

CVE-2023-46822: WordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Vendor Visser Labs
Product Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More
Weakness CWE-79 · XSS
Published November 6, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauth. Reflected Cross-Site Scripting') vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin <= 2.7.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Store Exporter for WooCommerce versions up to 2.7.2 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link or page that, when visited by a site administrator or user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in a user's browser to steal session tokens, credentials, or perform unauthorized actions.

Potential impact on your site

04Site Impact

Administrators or users visiting a crafted malicious link could have their sessions compromised or be tricked into performing unintended actions on the site.

Conditions required to exploit

05Prerequisites

Attacker must trick a user into visiting a malicious link or page (user interaction required). No authentication needed.

Key dates

06Disclosure timeline

November 6, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57356 WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability CVE-2026-27426 WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57351 WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57671 WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-27408 WordPress NativeChurch theme <= 4.8.8.2 - Reflected Cross Site Scripting (XSS) vulnerability