CVE-2021-25000

Summary

CVE	CVE-2021-25000
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-01-03 13:15:00 UTC
Updated	2022-01-08 02:35:00 UTC
Description	The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Booster	Booster For Woocommerce	All	All	All	All

References

Reference	Source	Link	Tags
Attention Required! \| Cloudflare	MISC	wpscan.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

LEGACY: Jeremie Amsellem

Legacy QID Mappings

150485 WordPress Booster for Woocommerce Plugin: Multiple Reflected Cross-Site Scripting Vulnerabilities (CVE-2021-24999,CVE-2021-25000,CVE-2021-25001)