WPify Woo Czech, bf3ea78681ccb672f188e5175ccf36ef8160eb18

CVE, Research URL: bf3ea78681ccb672f188e5175ccf36ef8160eb18
Home page URL: Security reports for WPify Woo Czech
Application: WPify Woo Czech
Published on: May 16, 2022
Research Description: WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce [wpify-woo] < 3.5.7 WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting The WPify Woo Czech plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of '$_SERVER['PHP_SELF']' with insufficient input sanitization and output escaping in versions up to, and including, 3.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.5.7.
Status: vulnerable