EAN for WooCommerce < 4.4.3 - Contributor+ Stored XSS

Vulnerability

The EAN for WooCommerce plugin for WordPress, versions before 4.4.3, fails to validate and escape shortcode attributes before outputting them in a page or post where the shortcode is embedded. This allows users with the contributor role or above to perform stored cross-site scripting (XSS) attacks [1].

Exploitation

An attacker with at least contributor-level access can insert a shortcode with malicious attribute values. The plugin does not sanitize these attributes, so when the shortcode is rendered, the attacker's JavaScript payload is executed in the context of any user viewing the affected page or post [1].

Impact

Successful exploitation leads to stored XSS, allowing the attacker to execute arbitrary JavaScript in the browsers of other users. Depending on the context, this could result in session hijacking, defacement, or redirection to malicious sites [1].

Mitigation

The vulnerability is fixed in version 4.4.3 of the plugin. Users are advised to update to the latest version immediately. No workarounds are mentioned in the reference [1].