CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Button Text for WooCommerce: from n/a through <= 2.2.2.
Explanation of Vulnerability in Simple Terms
The Change Add to Cart Button Text for WooCommerce plugin through version 2.2.2 contains a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into the plugin's settings. When other users, including administrators, view affected pages, the injected code executes in their browsers. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject and execute malicious JavaScript in the browsers of site visitors and administrators.
Potential impact on your site
Administrators and customers could have sessions hijacked, credentials stolen, or be tricked into performing unwanted actions on your store.
Conditions required to exploit
Attacker needs a low-privilege user account (e.g., subscriber or contributor) and the victim must view a page containing the injected content.
Key dates
External resources
Related vulnerabilities
