CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issue affects Currency Switcher for WooCommerce: from n/a through <= 0.0.7.
Explanation of Vulnerability in Simple Terms
Currency Switcher for WooCommerce versions 0.0.7 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the store without the admin's knowledge. The vulnerability requires user interaction and can affect the confidentiality, integrity, and availability of the site.
What an attacker can do
Trick a site admin into visiting a malicious page that performs unwanted actions on the store without their consent.
Potential impact on your site
An attacker can modify store settings, create unauthorized changes, or disrupt operations by exploiting admin sessions.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into WordPress. No special privileges or complex setup required.
Key dates
External resources
Related vulnerabilities
