CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
WooCommerce Order Search versions 1.1.0 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted link. The vulnerability affects the order search functionality and can compromise user sessions or steal sensitive data. Site owners should update to a version newer than 1.1.0.
What an attacker can do
Inject malicious scripts that run in a victim's browser when they click a crafted link.
Potential impact on your site
Users' sessions or credentials could be compromised if they interact with a malicious link targeting your site.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page that triggers the vulnerability.
Key dates
External resources
Related vulnerabilities
