CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.9.2.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Product Add-Ons versions 4.9.2 and earlier contain an improper input validation vulnerability that allows attackers to inject malicious content into product add-on fields. An attacker can modify stored data without authentication, potentially affecting how product information is displayed to customers. Update to a version newer than 4.9.2 to resolve this issue.
What an attacker can do
Inject malicious content into product add-on fields that gets stored and displayed on the site.
Potential impact on your site
Product add-on data may be corrupted or contain injected content visible to customers, affecting product presentation.
Conditions required to exploit
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
External resources
Related vulnerabilities
