CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-notices allows Stored XSS.This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through <= 1.2.10.
Explanation of Vulnerability in Simple Terms
Conditional Cart Messages for WooCommerce versions 1.2.10 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and can affect the site's data integrity and availability.
What an attacker can do
Trick a site admin into visiting a malicious page that performs unwanted actions on the site without their consent.
Potential impact on your site
An attacker can modify plugin settings or data by tricking admins into clicking malicious links, potentially disrupting cart messaging functionality.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into WordPress. No special privileges or complex setup required.
Key dates
External resources
Related vulnerabilities
