CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8.
Explanation of Vulnerability in Simple Terms
WooCommerce Shipping Label versions up to 2.3.8 contain a stored cross-site scripting (XSS) vulnerability. An authenticated admin can inject malicious scripts into shipping label fields. When other users view the affected labels, the scripts execute in their browsers, potentially compromising their sessions or data. The vulnerability requires admin privileges and user interaction to exploit.
What an attacker can do
Inject malicious scripts into shipping labels that execute when other users view them.
Potential impact on your site
A compromised admin account could inject scripts affecting other site users' sessions and data.
Conditions required to exploit
Admin-level access to the plugin and a user must view the affected shipping label.
Key dates
External resources
Related vulnerabilities
