PT-2018-10603 · Multidots · Advance Search For Woocommerce

Published 2018-06-01 · Updated 2018-07-02 · CVE-2018-11486

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MULTIDOTS Advance Search for WooCommerce plugin versions 1.0.9 and earlier

Description The issue is related to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.

Recommendations For MULTIDOTS Advance Search for WooCommerce plugin versions 1.0.9 and earlier, consider disabling the Custom CSS textarea field until a patch is available to prevent malicious JavaScript code injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11486

Affected Products

Advance Search For Woocommerce

References · 3

• 🔥 http://labs.threatpress.com/stored-cross-site-scripting-xss-in-advance-search-for-woocommerce-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11486 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11486 · Vendor Advisory