CVE-2023-5348: Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-18 · updated 2026-06-17
Weakness: CWE-79

Description

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.

Affected products

MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX: before 5.0.3 — fixed in 5.0.3

How to fix

Upgrade to a fixed version: MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX 5.0.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1
https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1

Get alerted when CVE-2023-5348 or the next vulnerability affects your stack