CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofx Local Shipping Labels for WooCommerce local-shipping-labels-for-woocommerce allows Reflected XSS.This issue affects Local Shipping Labels for WooCommerce: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
Local Shipping Labels for WooCommerce versions up to 1.0.0 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability requires user interaction—such as clicking a malicious link—and can affect multiple users across the site. Updating to a patched version is required to resolve this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, potentially stealing session cookies or redirecting users.
Potential impact on your site
Visitors and admins could be redirected, have sessions hijacked, or see fake content injected into your site.
Conditions required to exploit
No authentication required. Victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
