CVE-2021-24875CWE-79

eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

published November 23, 2021

CVSS
—
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01663 · 76.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-23T19:16Z
EPSS history
Timeline
  • 23 NOV 19:16Z
    eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting
    cvelistv5