B2Bking Premium
Monthly
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.