CVE-2020-11727 - Vulnerability Details - OpenCVE

A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Algolplus	Advanced Order Export For Woocommerce

Configuration 1 [-]

cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:3.1.3:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html
https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php
https://wordpress.org/plugins/woo-order-export-lite/#developers
https://www.themissinglink.com.au/security-advisories-cve-2020-11727

History

Wed, 20 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Algolplus advanced Order Export For Woocommerce
CPEs	cpe:2.3:a:algolplus:advanced_order_export:3.1.3:::::wordpress::	cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:3.1.3:::::wordpress::
Vendors & Products	Algolplus advanced Order Export	Algolplus advanced Order Export For Woocommerce

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-05-06T17:27:04

Updated: 2024-08-04T11:41:58.160Z

Reserved: 2020-04-12T00:00:00

Link: CVE-2020-11727

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-05-06T18:15:11.683

Modified: 2024-11-21T04:58:29.603

Link: CVE-2020-11727

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-05-06T17:27:04", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727"}, {"tags": ["x_refsource_MISC"], "url": "https://wordpress.org/plugins/woo-order-export-lite/#developers"}, {"tags": ["x_refsource_MISC"], "url": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-11727", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727", "refsource": "MISC", "url": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727"}, {"name": "https://wordpress.org/plugins/woo-order-export-lite/#developers", "refsource": "MISC", "url": "https://wordpress.org/plugins/woo-order-export-lite/#developers"}, {"name": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php", "refsource": "MISC", "url": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php"}, {"name": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:41:58.160Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wordpress.org/plugins/woo-order-export-lite/#developers"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-11727", "datePublished": "2020-05-06T17:27:04", "dateReserved": "2020-04-12T00:00:00", "dateUpdated": "2024-08-04T11:41:58.160Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:3.1.3:*:*:*:*:wordpress:*:*", "matchCriteriaId": "8497EBBA-284B-4801-9ED7-11962A9ED60F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el plugin AlgolPlus Advanced Order Export For WooCommerce versi\u00f3n 3.1.3, para WordPress, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del par\u00e1metro woe_post_type del archivo view/settings-form.php."}], "id": "CVE-2020-11727", "lastModified": "2024-11-21T04:58:29.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-05-06T18:15:11.683", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://wordpress.org/plugins/woo-order-export-lite/#developers"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://wordpress.org/plugins/woo-order-export-lite/#developers"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.themissinglink.com.au/security-advisories-cve-2020-11727"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}