CVE-2021-24169 Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
Reflected XSS in the Advanced Order Export for WooCommerce plugin allows attackers to execute scripts in admin sessions via the tab parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24169?
CVE-2021-24169 is a medium-severity cross-site scripting vulnerability in Unknown Advanced Order Export For WooCommerce, published on 5 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
Weakness: CWE-79
Which versions are affected by CVE-2021-24169?
It affects 1 product.
Products include Algolplus Advanced Order Export for Woocommerce.
How do I fix CVE-2021-24169?
No fix has been published for CVE-2021-24169 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-24169 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24169 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Unknown Advanced Order Export For WooCommerce
- CVE-2024-10828 Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details
- CVE-2018-11525 Code injection in n/a
- CVE-2021-27349 Cross-site scripting in n/a
- CVE-2020-11727 Cross-site scripting in n/a
- CVE-2022-35275 Cross-site scripting in Advanced Order Export For WooCommerce (WordPress plugin)
Sources
Also known as GHSA-w2gv-7447-6h8c.