Threats tagged 'ghsa-gm9j-8479-wxh3'

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.17.10. This flaw arises from insufficient input sanitization and output escaping of the inbound email body. An unauthenticated attacker can exploit this by injecting arbitrary web scripts that execute when a user views the affected page. The vulnerability is facilitated by the inbound email router relying solely on a regex match for a reply token in the References header, without cryptographic validation, allowing external parties to bypass authentication checks.