CVE-2023-33216
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The WooDiscuz – WooCommerce Comments plugin has a stored XSS vulnerability that can be exploited by users with admin privileges. This issue affects versions from n/a to 2.2.9.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. This poses a serious threat to the application's security and customer data.
Recommendation
It is recommended to update the WooDiscuz – WooCommerce Comments plugin to the latest version to mitigate this vulnerability. Additionally, a security audit of the application should be conducted.
Original NVD description (English source)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.