CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce acl-floating-cart-for-woocommerce allows Reflected XSS.This issue affects ACL Floating Cart for WooCommerce: from n/a through <= 0.9.
Explanation of Vulnerability in Simple Terms
ACL Floating Cart for WooCommerce versions 0.9 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they interact with the floating cart. The vulnerability requires user interaction and can affect multiple users on the site. Update to a version newer than 0.9 to resolve this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they interact with the floating cart.
Potential impact on your site
Attackers can steal customer data, session tokens, or redirect visitors to malicious sites via the floating cart.
Conditions required to exploit
Visitor must interact with the floating cart on an affected site; no authentication required.
Key dates
External resources
Related vulnerabilities
