CVE-2023-2256

CVE-2023-2256 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Product Addons & Fields for WooCommerce WordPress plugin prior to version 32.0.7. This medium-severity vulnerability, rated 6.1 CVSS, arises from insufficient sanitization of URL parameters, allowing an attacker to inject malicious scripts into a user's browser. Successful exploitation requires user interaction (UI:R) but can lead to information disclosure and integrity compromise (C:L/I:L). While there is no evidence of active exploitation (KEV: No) and no Metasploit or ExploitDB modules exist, Nuclei templates are available, indicating potential for automated discovery and exploitation. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness despite its FAUCET Risk Score of 89/100. Organizations using the affected plugin should update immediately to mitigate this risk.