CVE-2021-25077

6.1 mediumEPSS 0.9%

Medium (6.1) in visser store toolkit for woocommerce. EPSS 0.9% chance of exploitation in the next 30 days.

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-02-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

visser:store_toolkit_for_woocommerce

References

https://plugins.trac.wordpress.org/changeset/2654503
https://wpscan.com/vulnerability/53868650-aba0-4d07-89d2-a998bb0ee5f6
https://plugins.trac.wordpress.org/changeset/2654503
https://wpscan.com/vulnerability/53868650-aba0-4d07-89d2-a998bb0ee5f6

Check your stack JSON