Medium severity6.1NVD Advisory· Published Feb 7, 2022· Updated Jun 17, 2026

CVE-2021-25077

Description

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Visser/Store Toolkit For Woocommerce
cpe:2.3:a:visser:store_toolkit_for_woocommerce:*:*:*:*:*:wordpress:*:*
Range: <2.3.2
WordPress/Woocommerce Store Toolkitcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.3.2
Package: https://wordpress.org/plugins/woocommerce-store-toolkit

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2654503nvdPatchThird Party Advisory
wpscan.com/vulnerability/53868650-aba0-4d07-89d2-a998bb0ee5f6nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000