Threats tagged 'ghsa-gcmh-9x86-4rvc'

The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the 'wpf_fid' JSON parameter in all versions up to and including 3.4.6. The flaw is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. The vulnerability remains in versions patched at 3.4.3 because the sanitization was incomplete, leaving the JSON-decoded filterSettings payload unsanitized.