### [CVE-2019-1010124](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010124)
![](https://img.shields.io/static/v1?label=Product&message=WooCommerce%20Product%20Feed&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting%20(XSS)&color=brighgreen)

### Description

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.

### POC

#### Reference
- http://packetstormsecurity.com/files/154263/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html
- https://wpvulndb.com/vulnerabilities/9856
- https://www.youtube.com/watch?v=T-sqQDFRRBg

#### Github
No PoCs found on GitHub currently.