CVE-2018-11486 Advance Search for WooCommerce <= 1.0.9 - Cross-Site Scripting
MediumCVSS 6.1
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress woo-advance-search(WordPress) | < 1.1 | 1.1 |
| multidots advance search for woocommerce | <= 1.0.9 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- labs.threatpress.com exploit third-party-advisory