CVE-2023-2256

Deeper analysis

The vulnerability is a reflected cross-site scripting flaw (CWE-79) affecting the Product Addons & Fields for WooCommerce WordPress plugin prior to version 32.0.7. It stems from insufficient sanitization and escaping of certain URL parameters, allowing attacker-controlled input to be reflected in responses. The issue carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can exploit the flaw by crafting a malicious link containing injected script in the unsanitized parameters and tricking a victim into clicking it. Successful exploitation results in execution of arbitrary JavaScript in the victim's browser within the context of the affected site, enabling theft of session tokens, redirection, or other actions that impact confidentiality and integrity with changed scope.

The EPSS score stands at 0.2121 with no material rise from a lower baseline. WPScan references indicate the issue is resolved by updating the plugin to version 32.0.7 or later.