CVE-2022-4227

2022-12-2613:15:13

[email protected]

web.nvd.nist.gov

wordpress plugins

woocommerce

attribute security

reflected xss

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.7%

JSON

The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress plugin before 6.0.0 do not escape some URLs and parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Affected configurations

Nvd

Node

boosterbooster_elite_for_woocommerceRange<6.0.0wordpress

boosterbooster_for_woocommerceRange<5.6.3wordpress

boosterbooster_plus_for_woocommerceRange<6.0.0wordpress

VendorProductVersionCPE
boosterbooster_elite_for_woocommerce*cpe:2.3:a:booster:booster_elite_for_woocommerce:*:*:*:*:*:wordpress:*:*
boosterbooster_for_woocommerce*cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:*:wordpress:*:*
boosterbooster_plus_for_woocommerce*cpe:2.3:a:booster:booster_plus_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
booster	booster_elite_for_woocommerce	*	cpe:2.3:a:booster:booster_elite_for_woocommerce::::::wordpress::*
booster	booster_for_woocommerce	*	cpe:2.3:a:booster:booster_for_woocommerce::::::wordpress::*
booster	booster_plus_for_woocommerce	*	cpe:2.3:a:booster:booster_plus_for_woocommerce::::::wordpress::*