Flexstock Product Stock Sync With Google Sheets For Woocommerce
Monthly
Stored cross-site scripting in the FlexStock - Product Stock Sync with Google Sheets for WooCommerce plugin affects every version through 3.17.2, letting a logged-in Subscriber-level user write arbitrary script into the products[].post_content field that later executes in the browser of anyone viewing the injected page. The low barrier is structural rather than a misconfiguration: the plugin's admin_enqueue_scripts callback prints the REST bearer token into the Dashboard page source via wp_localize_script() with no capability check, and the REST endpoint's permission_callback validates only that token instead of calling current_user_can(), so any Subscriber can reach the write path without plugin-specific setup. Wordfence reported it as a medium-severity issue (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and priority is set to this month.
Stored cross-site scripting in the FlexStock - Product Stock Sync with Google Sheets for WooCommerce plugin affects every version through 3.17.2, letting a logged-in Subscriber-level user write arbitrary script into the products[].post_content field that later executes in the browser of anyone viewing the injected page. The low barrier is structural rather than a misconfiguration: the plugin's admin_enqueue_scripts callback prints the REST bearer token into the Dashboard page source via wp_localize_script() with no capability check, and the REST endpoint's permission_callback validates only that token instead of calling current_user_can(), so any Subscriber can reach the write path without plugin-specific setup. Wordfence reported it as a medium-severity issue (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and priority is set to this month.