CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in image files that will execute whenever a user accesses the injected page.
Explanation of Vulnerability in Simple Terms
Checkout Files Upload for WooCommerce versions up to 2.2.1 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts. The vulnerability affects the site's scope, potentially impacting other users and components. No user interaction is required for exploitation. Site administrators should update to a version newer than 2.2.1.
What an attacker can do
Inject malicious JavaScript that executes in users' browsers and affects other site components.
Potential impact on your site
Attackers can steal customer data, redirect users, or deface checkout pages without needing site credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
