CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through <= 2.0.
Explanation of Vulnerability in Simple Terms
Order Audit Log for WooCommerce versions 2.0 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators viewing audit logs. The vulnerability requires user interaction—the victim must visit a crafted page or click a malicious link. Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions on the site.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they view audit logs, potentially stealing credentials or hijacking sessions.
Potential impact on your site
Attackers can steal admin or customer session tokens, modify audit records, or perform actions as logged-in users without their knowledge.
Conditions required to exploit
No authentication required. The victim must visit a page containing the malicious payload or click a crafted link.
Key dates
External resources
Related vulnerabilities
