CVE-2022-1916

MEDIUMNuclei

Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1916 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 21, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Active Products Tables for WooCommerce. Professional products tables for WooCommerce store

CVE List1.0.5 to < 1.0.5affected

woot

Browse pluginus / woot
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site ScriptingCVSS 6.1

WordPress Active Products Tables for WooCommerce plugin prior to 1.0.5 contains a cross-site scripting vulnerability.. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to version 1.0.5 or later of the WordPress Active Products Tables for WooCommerce plugin to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsAkincibor
Template tagscvecve2022wordpresswp-pluginxsswpscanwppluginusvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:pluginus:woot:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d16a0c3d-4318-4ecd-9e65-fc4165af8808 https://nvd.nist.gov/vuln/detail/CVE-2022-1916 https://github.com/ARPSyndicate/kenzer-templates https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2