CVE-2022-0234CWE-79

CVE-2022-0234: vulnerability in WOOCS – Currency Switcher for WooCommerce.

WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 1.8%
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected products
Unknown · WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
Related CVEs — WOOCS – Currency Switcher for WooCommerce.

In the same product, most dangerous first.

CVE-2021-25043—WOOCS < 1.3.7.3 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-24938—WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site ScriptingEPSS 0.8%