CVE-2021-25018CWE-862

PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS

published February 14, 2022

CVSS
—
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-02-14T09:20Z
EPSS history
Timeline
  • 14 FEB 09:20Z
    PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS
    cvelistv5