CVE-2023-5348

6.1 mediumEPSS 0.5%

Medium (6.1) in multivendorx product catalog mode for woocommerce. EPSS 0.5% chance of exploitation in the next 30 days.

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

multivendorx:product_catalog_mode_for_woocommerce

References

https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1
https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1

Check your stack JSON