CVE-2023-0062
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
51/100
Published: 2023-02-06
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| wpfactory | ean_for_woocommerce | < 4.4.3 |
References & Advisories (1)
Exploit
Third Party Advisory