CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
The Change Cart button Colors WooCommerce plugin version 1.0 and earlier contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability affects the plugin's settings or cart functionality due to missing request validation.
What an attacker can do
Trick a site admin into visiting a malicious page that changes plugin settings or cart configuration without their consent.
Potential impact on your site
An attacker can modify your cart button colors or other plugin settings by tricking you into clicking a link while logged in.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special access or authentication required from attacker.
Key dates
External resources
