PT-2023-22728 · Woocommerce · Vark Minimum Purchase For Woocommerce

Abdi Pranata · Published 2023-10-26 · Updated 2023-10-30 · CVE-2023-30492

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vark Minimum Purchase for WooCommerce plugin versions <= 2.0.0.1

Description The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability. It affects users with contributor or higher permissions. The vulnerability allows for the storage and execution of malicious scripts, potentially leading to unauthorized access or data manipulation.

Recommendations For versions <= 2.0.0.1, update to a version higher than 2.0.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with contributor or higher permissions until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30492

Affected Products

Vark Minimum Purchase For Woocommerce

References · 6

• https://osv.dev/vulnerability/CVE-2023-30492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30492 · Security Note
• https://twitter.com/VulmonFeeds/status/1717552352876503345 · Twitter Post
• https://t.me/cibsecurity/72944 · Telegram Post
• https://patchstack.com/database/vulnerability/minimum-purchase-for-woocommerce/wordpress-minimum-purchase-for-woocommerce-plugin-2-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1717518651832832442 · Twitter Post