CVE-2023-0479medium

CVE-2023-0479: falha de média gravidade em Print Invoice & Delivery Notes for WooCommerce

Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Print Invoice & Delivery Notes for WooCommerce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.5%
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · Print Invoice & Delivery Notes for WooCommerce