Woocommerce Extra Product Options Pro
Monthly
Reflected cross-site scripting in ThemeHigh's WooCommerce Extra Product Options Pro plugin, affecting all versions up to and including 3.3.2, lets unauthenticated attackers inject arbitrary browser-side script through the '<fieldname>_start' and '<fieldname>_end' parameters of a Date & Time Range Picker extra field. The root cause is missing input sanitization combined with missing output escaping when those parameter values are reflected back into a WooCommerce product page. The attack is only reachable on product pages where a Date & Time Range Picker field has actually been configured, and the field name needed to build the payload is already visible in the page source, so discovery requires no prior knowledge; a victim must still be convinced to click a crafted link before the script runs in their session. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Reflected cross-site scripting in ThemeHigh's WooCommerce Extra Product Options Pro plugin, affecting all versions up to and including 3.3.2, lets unauthenticated attackers inject arbitrary browser-side script through the '<fieldname>_start' and '<fieldname>_end' parameters of a Date & Time Range Picker extra field. The root cause is missing input sanitization combined with missing output escaping when those parameter values are reflected back into a WooCommerce product page. The attack is only reachable on product pages where a Date & Time Range Picker field has actually been configured, and the field name needed to build the payload is already visible in the page source, so discovery requires no prior knowledge; a victim must still be convinced to click a crafted link before the script runs in their session. No public exploit code and no confirmed active exploitation were identified at time of analysis.