CVE-2021-24999

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 56.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Booster FOR WoocommerceBooster Booster FOR Woocommerce
Timeline
PublishedJan 3
Latest updateJan 4

Description

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/booster_for_woocommerce5.4.9 — 5.4.9
▶NVDbooster/booster< 5.4.9

🔴Vulnerability Details

2
GHSA
GHSA-7rmc-hrm5-375w: The Booster for WooCommerce WordPress plugin before 5↗2022-01-04
▶
CVEList
Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module↗2022-01-03
▶