CVE-2019-1010124 Cross-site scripting in WooCommerce Product Feed
An authenticated administrator can exploit XSS to achieve remote code execution by editing theme files in the WooCommerce Product Feed plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-1010124?
CVE-2019-1010124 is a medium-severity cross-site scripting vulnerability in WebAppick WooCommerce Product Feed, published on 23 Jul 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
Weakness: CWE-79
Which versions are affected by CVE-2019-1010124?
It affects 1 product.
Products include Webappick Woocommerce Product Feed.
How do I fix CVE-2019-1010124?
No fix has been published for CVE-2019-1010124 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-1010124 being exploited?
There is no known exploitation of CVE-2019-1010124 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-mpgf-25r6-7jp3.