QwikSec

Security Database

CVE

CWE

Training

CVE-2021-24974

Published: Jan 24, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.

Vendor	Product	Versions
Unknown	Product Feed PRO for WooCommerce	affected `11.0.7 - < 11.0.7`

Weaknesses (CWE)

References

https://wpscan.com/vulnerability/8ed549fe-7d27-4a7a-b226-c20252964b29

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.