CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7.
Explanation of Vulnerability in Simple Terms
Doofinder WP & WooCommerce Search versions up to 2.1.7 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they interact with search functionality. The vulnerability requires user interaction and can affect multiple users across the site. Update to a version newer than 2.1.7 to remediate.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they use the search feature.
Potential impact on your site
Attackers can steal visitor session tokens, redirect users, or deface search results without needing site admin access.
Conditions required to exploit
Visitor must interact with the search functionality; no authentication required.
Key dates
External resources
Related vulnerabilities
