CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order meta in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
The Where Did You Hear About Us Checkout Field plugin for WooCommerce contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.3.1. An authenticated admin can inject malicious scripts into checkout field data that execute in other users' browsers when they view the affected content. The vulnerability requires high-level privileges to exploit but can affect site visitors across the platform.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they interact with checkout fields.
Potential impact on your site
An admin account compromise could inject malware or steal customer data through checkout pages.
Conditions required to exploit
Attacker must have admin-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
