Description
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Product Addons & Fields for WooCommerce | < 32.0.7 | 32.0.7 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting http/cves/2023/CVE-2023-2256.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb exploit vdb-entry technical-description