PT-2023-17007 · WordPress · Wp Express Checkout
Ayoub Safa
·
Publicado
2023-03-17
·
Atualizado
2023-03-23
·
CVE-2023-1469
CVSS v3.1
4.8
Média
| Vetor | AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WP Express Checkout plugin for WordPress versions up to, and including, 2.2.8
Description
The issue is related to Stored Cross-Site Scripting via the
pec coupon[code] parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can potentially be exploited by lower-privileged users if the Admin Dashboard Access Permission setting is set for those users to access the dashboard.Recommendations
For WP Express Checkout plugin for WordPress versions up to, and including, 2.2.8, update to a version higher than 2.2.8 to resolve the issue. As a temporary workaround, consider restricting access to the dashboard by adjusting the
Admin Dashboard Access Permission setting to prevent lower-privileged users from exploiting the vulnerability. Additionally, restrict the use of the pec coupon[code] parameter until a patch is available.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Wp Express Checkout