CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1.
Explanation of Vulnerability in Simple Terms
The CC & BCC for WooCommerce Order Emails plugin through version 1.4.1 contains a stored cross-site scripting (XSS) vulnerability. An authenticated admin can inject malicious scripts into email configuration fields. When other users or admins view affected pages, the scripts execute in their browsers, potentially compromising their sessions or stealing data.
What an attacker can do
Inject and store malicious JavaScript that executes when admins view plugin settings or email logs.
Potential impact on your site
Admin accounts could be compromised; session tokens or sensitive data could be stolen if an admin views affected pages.
Conditions required to exploit
Attacker must have admin-level access to the WordPress site and trick an admin into viewing a page with the injected payload.
Key dates
External resources
Related vulnerabilities
