CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.
Explanation of Vulnerability in Simple Terms
The WooCommerce Menu Extension through version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability in menu configuration. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors, potentially compromising their sessions or stealing data. The vulnerability requires user interaction to trigger the payload.
What an attacker can do
Inject malicious scripts into menu settings that execute when other users view the site.
Potential impact on your site
Visitors' sessions could be hijacked, credentials stolen, or malware injected into pages they view.
Conditions required to exploit
Attacker needs a low-privilege account (e.g., contributor or editor) and a victim must visit a page displaying the affected menu.
Key dates
External resources
Related vulnerabilities
