Soteshop Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in Soteshop versions prior to 8.3.4. This vulnerability allows remote attackers to execute arbitrary code by exploiting the 'query' parameter in the '/app-google-custom-search/searchResults' endpoint. The exploitation of this issue could lead to the theft of sensitive user data, such as session cookies, or allow attackers to perform actions on behalf of the user.

Impact

Exploitation of this vulnerability could result in Cross-Site Scripting, allowing for the execution of malicious scripts in the context of the user's session.

Remediation

Users can upgrade to Soteshop version 8.3.4 or later to address this vulnerability.