WordPress Plugin Vulnerabilities

Biteship < 2.2.28 - Shop manager+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as Shop Manager and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
biteship
Fixed in 2.2.28

References

CVE
CVE-2023-49767
URL
https://patchstack.com/database/vulnerability/biteship/wordpress-biteship-plugin-2-2-22-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Luqman Hakim Y
Verified
No
WPVDB ID
ded91e68-5831-4d34-86a8-5a6866315c78

Timeline

Publicly Published
2023-12-04 (about 5 months ago)
Added
2023-12-09 (about 5 months ago)
Last Updated
2024-03-25 (about 1 months ago)

Other

Published
Title
Published
2023-03-15
Title
PB SEO Friendly Images <= 4.0.5 - Admin+ Stored XSS
Published
2023-10-04
Title
Geo Controller < 8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-26
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.4.3 - Reflected Cross-Site Scripting
Published
2023-04-06
Title
The7 < 11.6.1 - Reflected XSS
Published
2023-02-21
Title
Japanized For WooCommerce < 2.5.5 - Reflected XSS