CVE-2022-43463: WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Verified

Fixed

4.8

CVSS 3.1 score Medium severity

Report

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.7.9

PSID

de287f0e19f1

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Required privilege

Requires high role user authentication like admin.

Publicly disclosed

2022-10-30

Details

Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Custom Product Tabs for WooCommerce plugin (versions <= 1.7.9).

Solution

Update the WordPress Custom Product Tabs for WooCommerce plugin to the latest available version (at least 1.8.0).

References