Skip to content
CVE Tracker
Back

CVE-2022-2575

WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSS

Medium4.8EPSS 0.60%
Published
Updated
Reserved
Assigned by
WPScan

Description

The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Scores

CVSS scores of CVE-2022-2575, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium4.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.60% · top 51% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

Affected products

  • Unknown · WBW Currency Switcher for WooCommerce

    • affected 1.6.6 – < 1.6.6

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .