Saphali Woocommerce Lite <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Catalogue Column Count Setting
- ID
- WPSEC-2026-3160
- Plugin
- Saphali Woocommerce Lite (saphali-woocommerce-lite)
- Affected
- from 2.0.0 before 2.0.3
- Remediation
- Update to 2.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-15
- Attack surface
- Saphali Woocommerce Lite on WPSec AttackSurface
- Fix released
- Published
Description
The Saphali Woocommerce Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0.0 up to, and including, 2.0.2. This is due to a nonce check on the plugin's settings page that is skipped whenever a 'saphali_save_fields' or 'saphali_reset_fields' parameter is present, and to the catalogue column count handler having no nonce check of its own. The submitted value is stored without sanitization and printed without escaping in the settings form. This makes it possible for unauthenticated attackers to change the catalogue column count setting and inject arbitrary web scripts into the plugin's settings page via a forged request, provided they can trick a site administrator or shop manager into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-3160/
- https://plugins.svn.wordpress.org/saphali-woocommerce-lite/tags/2.0.3/
- https://wordpress.org/plugins/saphali-woocommerce-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS