CVE-2021-24974
Medium
Description
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
SeverityMedium
CVSS5.4
Exploit probability—
ProductAdtribes Product Feed Pro For Woocommerce
PublishedJan 24, 2022
First seenJan 24, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- adtribes product_feed_pro_for_woocommerce11.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| adtribes product_feed_pro_for_woocommerce | v < 11.0.7 | 11.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.