European Vat Compliance Assistant For Woocommerce
Monthly
Stored cross-site scripting in the European VAT Compliance Assistant for WooCommerce plugin (all versions through 1.36.10) allows unauthenticated attackers to plant arbitrary script by controlling the CF-IPCountry header during a guest checkout; the value is persisted verbatim in order post-meta and executes when a store administrator views the order in wp-admin. The main constraint is header controllability - CF-IPCountry is normally set by Cloudflare, so injection is practical only where the store is not behind Cloudflare or the edge does not overwrite client-supplied values - and a privileged user must subsequently open the affected order. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the unauthenticated planting path and execution in the admin context warrant prompt patching.
Stored cross-site scripting in the European VAT Compliance Assistant for WooCommerce plugin (all versions through 1.36.10) allows unauthenticated attackers to plant arbitrary script by controlling the CF-IPCountry header during a guest checkout; the value is persisted verbatim in order post-meta and executes when a store administrator views the order in wp-admin. The main constraint is header controllability - CF-IPCountry is normally set by Cloudflare, so injection is practical only where the store is not behind Cloudflare or the edge does not overwrite client-supplied values - and a privileged user must subsequently open the affected order. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the unauthenticated planting path and execution in the admin context warrant prompt patching.