Skip to content
Sign in
Not rated

CVE-2021-24938 The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the…

Description

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue

Affected products and versions

Product Affected versions Fixed in
WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency 1.3 earliest → < 1.3.7.1 1.3.7.1

Other CVEs of WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency

The 3 CVEs of WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency →
CVE-2022-0234 The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the… Not rated CVE-2021-25043 The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting… Not rated
Track this CVE