CVE-2023-3954

31th percentile - higher than 31% of all known CVEs

The MultiParcels Shipping For WooCommerce plugin before version 1.15.4 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as admins.

This vulnerability poses a risk to the organization as an attacker could exploit it to perform XSS attacks on high privilege users, potentially leading to account takeover or exposure of sensitive information.

It is recommended to update the plugin to version 1.15.4 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.