CVE-2023-37873

HighCVSS 7.1

Published: 05/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The WooCommerce Shipping Multiple Addresses plugin versions <= 3.8.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

Risk Assessment

Exploitation of this vulnerability could lead to user data theft or session hijacking, posing a significant security risk to the organization.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Other vulnerabilities in WooCommerce Shipping Multiple Addresses plugin

CVE-2023-36514Medium
The WooCommerce Shipping Multiple Addresses plugin versions up to 3.8.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

Original NVD description (English source)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS