Wpc Estimated Delivery Date For Woocommerce
Monthly
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.