CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through <= 5.1.0.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Ajax Product Filter versions up to 5.1.0 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a visitor's browser when they interact with the product filter. The vulnerability requires user interaction and network access but no authentication. Affected sites should update to a version newer than 5.1.0.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they use the product filter.
Potential impact on your site
Visitors' browsers can execute attacker-controlled code, risking session hijacking, credential theft, or malware distribution.
Conditions required to exploit
Visitor must interact with the product filter on the affected site; attacker needs network access.
Key dates
External resources
Related vulnerabilities
