Lucene search
JrXnmWPEX-ID:B960CB36-62DE-4B9F-A35D-144A34A4C63DHistoryNov 15, 2021 - 12:00 a.m.
Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting
2021-11-1500:00:00
JrXnm
97
pixel cat lite
cross-site scripting
plugin vulnerability
google product category
e-commerce
woocommerce
EPSS
0.001
Percentile
24.8%
The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Put the following payload in the Google Product Category setting of the plugin (at wp-admin/admin.php?page=fca_pc_settings_page in the E-Commerce > Advanced Feed Settings, needs WooCommerce activated): ' style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be trigged when showing the setting againRelated
cve
cve
CVE-2021-24972
2021-12-13 11:15:09
prion
prion
Cross site scripting
2021-12-13 11:15:00
patchstack
patchstack
wpvulndb
wpvulndb
Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting
2021-11-15 00:00:00
cvelist
cvelist
CVE-2021-24972 Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting
2021-12-13 10:41:32
nvd
nvd
CVE-2021-24972
2021-12-13 11:15:09