CVE-2021-25043: 
WordPress vulnerability analysis and mitigation

The WOOCS (WooCommerce Currency Switcher) WordPress plugin versions before 1.3.7.3 contains a Reflected Cross-Site Scripting vulnerability identified as CVE-2021-25043. The vulnerability was discovered by Krzysztof Zając and was publicly disclosed on December 13, 2021. This security issue affects the WordPress plugin woocommerce-currency-switcher (WPScan).

The vulnerability stems from improper sanitization and escaping of the custom_prices parameter in the plugin's functionality. When this parameter is processed, its value is output back in the response without proper security measures, enabling a reflected XSS attack. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If exploited, this vulnerability could allow attackers to execute malicious JavaScript code in victims' browsers. The attack requires user interaction and can potentially lead to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS scoring indicates low impact on both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability has been patched in version 1.3.7.3 of the WOOCS plugin. Site administrators are strongly advised to update to this version or later to mitigate the risk. The fix can be found in the WordPress plugin repository (WordPress Plugin).