CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The Stock History & Reports Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_stock_snapshot_restocked shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in Stock History & Reports Manager for WooCommerce plugin versions up to 2.2.2 allows authenticated contributors and above to inject arbitrary JavaScript through the 'alg_wc_stock_snapshot_restocked' shortcode attributes due to insufficient input sanitization and output escaping. When an injected page is accessed, the malicious script executes in the context of all visitors' browsers, potentially compromising site users and enabling credential theft, malware distribution, or account takeover. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability exists in the Stock History & Reports Manager for WooCommerce plugin (identified via WordPress plugin repository https://plugins.trac.wordpress.org/browser/stock-snapshot-for-woocommerce/) at the shortcode handler for 'alg_wc_stock_snapshot_restocked' in the class-alg-wc-stock-snapshot-shortcodes.php file (line 174 per reference). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied shortcode attributes are not properly sanitized before being processed or escaped before output to the page. Shortcodes in WordPress are a mechanism for embedding dynamic content via [shortcode-name] syntax in post/page content; when attributes passed to shortcodes lack sanitization and escaping, they become a vector for injecting malicious HTML and JavaScript that persists in the post/page content (stored XSS). The vulnerability requires the attacker to have at least contributor-level WordPress user access (the lowest tier that can publish posts/pages and add/edit shortcodes), which restricts the attack surface to trusted user accounts or compromised accounts with those privileges.
Affected ProductsAI
The Stock History & Reports Manager for WooCommerce plugin (also marketed as Stock Snapshot for WooCommerce) in all versions up to and including 2.2.2 is affected. The plugin is distributed via the official WordPress plugin repository at https://wordpress.org/plugins/stock-snapshot-for-woocommerce/. No specific safe version is identified in the references, though the plugin changelog (https://plugins.trac.wordpress.org/changeset/3376453/) indicates that remediation has been committed upstream. The vulnerability impacts WordPress sites running the plugin at version 2.2.2 or earlier.
RemediationAI
Site administrators should update the Stock History & Reports Manager for WooCommerce plugin to a patched version beyond 2.2.2. Per the upstream changeset at https://plugins.trac.wordpress.org/changeset/3376453/, a fix has been applied; check the WordPress plugin repository (https://wordpress.org/plugins/stock-snapshot-for-woocommerce/) or the plugin's settings in the WordPress dashboard to confirm the latest available version and install it immediately. For sites unable to update immediately, restrict contributor-level access to only trusted users and audit existing pages and posts for any suspicious shortcode attributes or script content. Additionally, review the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/13ffe550-699a-4244-b0e1-859c113d77c0?source=cve) for detailed mitigation guidance and site scan recommendations.
Share
External POC / Exploit Code
Leaving vuln.today