Midtrans Woocommerce
Monthly
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.