CVE-2023-33319

HighCVSS 7.1

Published: 28/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

The WooCommerce Follow-Up Emails (AutomateWoo) plugin versions up to 4.9.40 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

Risk Assessment

This vulnerability may lead to user data theft and session hijacking, posing a serious security risk to the organization.

Recommendation

It is recommended to update the WooCommerce Follow-Up Emails plugin to the latest version to mitigate this security issue.

Other vulnerabilities in WooCommerce Follow-Up Emails (AutomateWoo) plugin

CVE-2023-33316Medium
The WooCommerce Follow-Up Emails (AutomateWoo) plugin versions <= 4.9.40 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.

Original NVD description (English source)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS