Yith Woocommerce Compare
Monthly
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.