CVE-2021-24991 WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting · CloudMap

中危CVE-2021-24991

WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting

披露于 2022/01/03 · 更新于 2025/08/12

CVSS 评分4.8/ 10.0

EPSS 概率2.5%百分位 84.7%

漏洞描述

The Wordpress plugin WooCommerce PDF Invoices & Packing Slips before 2.10.5 does not escape the tab and section parameters before reflecting it an attribute, leading to a reflected cross-site scripting in the admin dashboard.

影响产品

wp-pluginWooCommerce查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

wpscan.comhttps://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-24991↗github.comhttps://github.com/ARPSyndicate/cvemon↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗

RELATED INTELLIGENCE

同产品关联漏洞

与 WooCommerce 相关的其他公开漏洞。

查看全部 →

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
elex_woocommerce_xss WordPress WooCommerce Google Shopping < 1.2.4 - Cross-Site Scripting WooCommerce	高危	7.2	—	PoCEXP	2023/11/27
checkout_fields_manager_xss WordPress Checkout Fields Manager for WooCommerce <5.5.7 - Cross-Site Scripting WooCommerce	中危	5.4	—	PoCEXP	2023/11/27
wp_woocommerce_email_verification Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass WooCommerce	严重	10.0	—	PoCEXP	2023/11/11
wp_woocommerce_file_download Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download WooCommerce	高危	8.6	—	PoCEXP	2023/10/20
CVE-2022-0234 WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting WooCommerce	中危	6.1	2.6%	PoCEXP	2022/02/23
CVE-2021-25085 WOOF WordPress plugin - Cross-Site Scripting WooCommerce	中危	6.1	3.2%	PoCEXP	2022/02/01