cve-2020-36731

{
  "cvss": 7.2,
  "datePublished": "2020-02-27T00:00:00Z",
  "dateUpdated": "2020-02-27T00:00:00Z",
  "description": "The Flexible Checkout Fields for WooCommerce  plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.",
  "dueDate": "",
  "id": "CVE-2020-36731",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "flexible_checkout_fields",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "wpdesk flexible_checkout_fields Improper Neutralization of Input During Web Page Generation",
  "vendor": "wpdesk"
}