CVE-2023-5348 - Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update

Back Back to CVE browser

MEDIUM

Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update

Published Dec 18, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.

Affected products

Vendor n/a Product Product Catalog Mode For WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Product Catalog Mode For WooCommerce

unaffected

Version	Status	Constraints
0	affected	<5.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Dec 18, 2023

Updated Aug 2, 2024

Reserved Oct 3, 2023

Link CVE-2023-5348

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-5348

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-5348