CVE-2022-4661
Woo Products Widgets For Elementor < 1.0.8 - Contributor+ Stored XSS via Shortcode
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Mar 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected products
Unknown · Widgets for WooCommerce Products on ElementorWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →