Giftit 8211 Free Gifts For Woocommerce
Monthly
Content injection in the GIFTiT - Free Gifts for WooCommerce WordPress plugin, in all versions through 4.5, allows attacker-supplied script-related HTML to reach a rendered page without neutralization (CWE-80). The assessed impact is bounded - low confidentiality and low integrity with a scope change - meaning limited data exposure or tampering within the affected site rather than code execution on the server; the vendor-reported CVSS 3.1 base score is 5.3. No CISA KEV entry or public exploit code is associated with this CVE, and the privilege and interaction prerequisites are not fully settled: the assessed vector lists PR:L (authenticated) while the originally supplied vector lists PR:N with UI:N, so the practical prerequisites should be confirmed against the Patchstack advisory before relying on either.
Content injection in the GIFTiT - Free Gifts for WooCommerce WordPress plugin, in all versions through 4.5, allows attacker-supplied script-related HTML to reach a rendered page without neutralization (CWE-80). The assessed impact is bounded - low confidentiality and low integrity with a scope change - meaning limited data exposure or tampering within the affected site rather than code execution on the server; the vendor-reported CVSS 3.1 base score is 5.3. No CISA KEV entry or public exploit code is associated with this CVE, and the privilege and interaction prerequisites are not fully settled: the assessed vector lists PR:L (authenticated) while the originally supplied vector lists PR:N with UI:N, so the practical prerequisites should be confirmed against the Patchstack advisory before relying on either.