Access violation vulnerability in XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] 1.6.4

The XPlainer plugin for WordPress, specifically the WooCommerce Product FAQ plugin, has a security vulnerability. This means that people who are not authorized can change the data without permission. This happens because the ‘ffw_activate_template’ function does not have a check to make sure the person has the right capabilities. This vulnerability exists in all versions up to 1.6.4. As a result, attackers who have access to Subscriber-level or higher can store code that can cause cross-site scripting. This means that the code can run when someone is viewing the dashboard templates or accessing FAQs.