CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7151 – Product Enquiry for WooCommerce < 3.2 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-7151
15 Jan 2024 — The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento Product Enquiry for WooCommerce para WordPress anterior a 3.2 no sanitiza ni escapa el parámetro page antes de devolverlo en un atributo, lo que genera cross site scripting reflejado que podría usarse contra usuarios con privilegios el... • https://wpscan.com/vulnerability/4992a4a9-f21a-46e2-babf-954acfc7c5b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29170 – WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-29170
03 Apr 2023 — Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin <= 2.2.12 versions. The Product Enquiry for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers , with administrator-level access and above, to inject arbitrary web s... • https://patchstack.com/database/vulnerability/enquiry-quotation-for-woocommerce/wordpress-product-enquiry-for-woocommerce-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •