CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IconicWP WooThumbs for WooCommerce by Iconic allows Reflected XSS.This issue affects WooThumbs for WooCommerce by Iconic: from n/a through 5.5.3.
Explanation of Vulnerability in Simple Terms
WooThumbs for WooCommerce versions up to 5.5.3 contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts into product pages. An attacker can craft a malicious link that, when visited by a site visitor, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or malware distribution. Site owners should update to a version newer than 5.5.3.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers via crafted product page links.
Potential impact on your site
Visitors' sessions, credentials, and personal data can be compromised; site reputation and customer trust at risk.
Conditions required to exploit
A site visitor must click a malicious link or visit a compromised product page; no authentication required.
Key dates
External resources
Related vulnerabilities
