CVE-2023-3671
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.
Risk Assessment
The organization may be exposed to XSS attacks that could lead to the compromise of admin accounts and data theft. The high privileges of users may increase the risk of serious security incidents.
Recommendation
It is recommended to update the plugin to version 1.15.4 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.
Original NVD description (English source)
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin