Wpc Smart Quick View For Woocommerce
Monthly
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.