CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Ajax Search versions 2.4.0 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in users' browsers when they interact with search functionality. The vulnerability affects all visitors without requiring authentication or user interaction beyond normal site use. This can lead to session hijacking, credential theft, or malware distribution.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session cookies or credentials.
Potential impact on your site
Visitors' browsers can be compromised when using the search feature, risking account takeover and data theft.
Conditions required to exploit
No authentication required. Attacker can exploit this remotely via network access to the site.
Key dates
External resources
Related vulnerabilities
