Threats tagged 'ghsa-x5m4-f9xg-mvjw'

The WooCommerce Vindi Pagamento WordPress plugin up to version 0.8.3 lacks authorization checks when updating an order's shipment tracking code and fails to escape this code when displayed on the order edit page. This allows unauthenticated attackers to inject stored cross-site scripting (XSS) payloads that execute when administrators or shop managers view affected orders. The vulnerability affects sites using WooCommerce's legacy order storage system.