CVE-2023-3954

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.1%

top 67.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Multiparcels Shipping FOR Woocommerce Multiparcels Multiparcels Shipping FOR Woocommerce

Timeline

PublishedAug 21

Description

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/multiparcels_shipping_for_woocommerce1.15.2 — 1.15.4

▶NVDmultiparcels/multiparcels_shipping< 1.15.4

🔴Vulnerability Details

GHSA

GHSA-ccq7-hh37-hcx6: The MultiParcels Shipping For WooCommerce WordPress plugin before 1↗2023-08-21

▶

CVEList

MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS↗2023-08-21

▶