blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-1010124

MEDIUM 5.4 CVSS 3.1
Published
July 23, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
josh@bress.net
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.

Affected products and versions

  • WebAppick WooCommerce Product Feed — Version ≤ 2.2.18
  • webappick woocommerce_product_feed — Up to and including 2.2.18

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/154263/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9856 Third Party Advisory
  • www.youtube.com https://www.youtube.com/watch?v=T-sqQDFRRBg Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record