Woocommerce
Monthly
Stored cross-site scripting in VillaTheme Email Template Customizer for WooCommerce (versions up to and including 1.2.17) allows an authenticated high-privilege user to inject malicious JavaScript into email template fields, which then executes in the browser of another user who views the affected template. The flaw requires both elevated privileges (PR:H) and victim interaction (UI:R), and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.18%).
Unauthenticated blind SQL injection in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin (all versions up to and including 1.3.7.1) allows a remote attacker to append arbitrary SQL to the text-search query via the `phrase` parameter and read sensitive data from the site's database through blind extraction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms no authentication, no privileges and no user interaction are required, and impact is confined to confidentiality with no integrity or availability effect. Real-world risk is constrained by a product-specific precondition (the plugin, and its by_text_2 text-phrase filter, must be installed, active and reachable) and by weak exploitation signals: EPSS is only 0.35% (26th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Product Filter by WBW (slug woo-product-filter) affects all versions up to and including 2.9.7, allowing remote attackers to inject arbitrary SQL through the 'filtersDataBackend' parameter and read sensitive data from the site's database. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication, no privileges, and no user interaction - any public-facing WordPress site with the vulnerable plugin active is directly exposed, with confidentiality impact rated High and no integrity or availability impact. There is no public exploit code identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.39% (31st percentile), but given the trivial unauthenticated access path this remains a genuine, actionable priority for any site running the affected plugin.
Cross-Site Request Forgery (CSRF) in the WooCommerce Simple Registration plugin for WordPress (versions up to and including 1.5.8) allows unauthenticated attackers to approve pending role requests and escalate user privileges by tricking an authenticated site administrator into clicking a crafted link. The flaw is missing nonce validation in the role-approval handler, and exploitation requires an existing pending role request plus administrator interaction, making it conditional rather than opportunistic. No public exploit has been identified, and the EPSS score is low (0.20%, 9th percentile).
Incorrect authorization in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.8.4) lets an authenticated user with Editor-level capabilities or higher reach the plugin's license-management routes and activate or deactivate the site's license without proper permission checks. The flaw is confined to license state manipulation - there is no path to code execution or data disclosure - and the vendor shipped a fix in version 4.8.5. No active exploitation is indicated (not in CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is 0.22% (12th percentile), consistent with a low-severity, low-real-risk issue.
Reflected cross-site scripting in the VNPAY Payment Gateway plugin for WordPress (slug vnpay-for-woocommerce) versions up to and including 1.0.0 lets remote attackers inject arbitrary script through the 'message' parameter handled by the Thankyou shortcode. Exploitation is not autonomous: per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker authentication is required, but a victim must be socially engineered into clicking a crafted link before the non-persistent payload executes in their browser. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.22% (11th percentile), so this reads as a genuine but low-priority issue rather than a critical one.
PHP object injection in the Acowebs Product Table For WooCommerce plugin (affected through version 1.2.4) lets an authenticated attacker supply serialized PHP data that the plugin passes to unserialize(), potentially leading to arbitrary object instantiation within the WordPress process. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) and requires a valid low-privilege WordPress session - such as a subscriber or WooCommerce customer account on stores that permit open registration; concrete impact such as file deletion, data exfiltration, or remote code execution depends on the presence of a usable POP gadget chain in WordPress core, WooCommerce, or installed themes/plugins, which is not confirmed in the source data. No public exploit identified at time of analysis, the issue does not appear in CISA KEV, and EPSS is 0.52% (42nd percentile), indicating low predicted exploitation activity at this time.
Privilege escalation in the extendons WooCommerce Registration Fields Plugin - Custom Signup Fields (slug extendons-registration-fields) at versions up to and including 3.2.3 allows an authenticated low-privilege user - for example a self-registered WooCommerce customer or subscriber, which is trivial to obtain on stores with open registration - to escalate their account to administrator over the network with no user interaction. The defect is an incorrect privilege assignment (CWE-266) in the plugin's custom signup/registration field handling, and because the resulting administrator role grants full content, configuration and user control, confidentiality, integrity and availability impacts are all rated high. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.39% (31st percentile), so this is a credible, actionable priority rather than an inflated CVSS score, contingent on the plugin being installed and active and on the attacker being able to register an account.
ShopMagic for WooCommerce, a WordPress marketing-automation plugin, embeds sensitive information into data it sends out in versions through 4.5.6, letting unauthenticated remote attackers retrieve that embedded data. The Patchstack-assigned CVSS 3.1 base score is 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), while our independent assessment scores it 5.3 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N because the scope-change is not clearly justified; the CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are required. EPSS is low at 0.31% (22nd percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. Impact is limited to disclosure of a modest amount of sensitive data, with no integrity or availability effect, but exploitation requires a WooCommerce site running the vulnerable plugin version.
Reflected cross-site scripting in the WC Return products WordPress plugin (all versions up to and including 1.5) allows remote attackers to execute arbitrary script in a victim's browser session by luring that victim to a crafted URL whose input is reflected unsanitized into a page the plugin generates. Per the authoritative assessment (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker-side authentication is required (PR:N) but exploitation hinges on victim interaction (UI:R), so the attacker cannot trigger execution autonomously and impact is bounded by the clicking victim's session privileges. Only sites with the plugin installed and active are reachable via this code path; EPSS is low (0.25%, 15th percentile), the flaw is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin Finale Lite (sold as 'finale-woocommerce-sales-countdown-timer-discount') affects all versions up to and including 2.20.0, letting an attacker reflect unsanitized input back to a victim's browser through the vulnerable plugin endpoint. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), no authentication is required to deliver a payload, but successful exploitation depends on tricking a user into clicking a crafted link or submitting crafted input into a page that echoes it back. There is no public exploit identified at time of analysis and no CISA KEV listing, though the plugin's WooCommerce/e-commerce footprint makes administrative sessions a valuable target; sites running the plugin should treat this as a moderate, interaction-dependent risk.
Reflected cross-site scripting in the extendons WooCommerce Registration Fields plugin - Custom Signup Fields (extendons-registration-fields) for WordPress, affecting all versions through 3.2.3, allows remote attackers to inject and execute arbitrary script in the browser of a user who opens a crafted link. Exploitation is unauthenticated from the attacker's side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but depends on social engineering, since each victim must be lured into opening the malicious URL; impact is confined to the victim's browser session within the WordPress site's origin rather than to the server or host. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.28% (19th percentile), making this a moderate-priority patch item rather than an emergency.
Reflected cross-site scripting in the WordPress plugin WooCommerce Vehicle Parts Finder (versions up to and including 3.7) lets remote attackers inject script into a page generated from unsanitized input, which executes in the browser of any user who opens a crafted link. Exploitation requires victim interaction - the attacker only delivers a URL, so a site administrator or shop manager with an active logged-in session is the highest-value target, and the plugin's narrow install base further limits real-world impact. Risk signals are low: EPSS is 0.23% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; no vendor-released patch was identified in the available data, so the Patchstack advisory should be monitored for a fixed release even though patching guidance is not yet confirmed.
Stored cross-site scripting (XSS) in the WPC Countdown Timer for WooCommerce plugin (versions up to and including 3.1.4) enables an authenticated attacker with low-level privileges to inject malicious JavaScript into countdown timer settings. The payload executes in the browser of any user who views the affected page, potentially allowing session theft or defacement. No public exploit code has been identified and the EPSS score is low (0.20%), but the plugin's use in e-commerce sites warrants prompt patching per the Patchstack advisory.
Authenticated WordPress users with subscriber-level privileges or above can submit refund requests against arbitrary WooCommerce orders they do not own in the Flexible Refund and Return Order for WooCommerce plugin through version 1.0.38, because the save_refund_request() function performs no ownership or authorization check on the supplied order identifier (CWE-639). The impact is integrity-only - unauthorized refund requests are created in the store's workflow, but there is no confidentiality or availability impact, and no administrative access or user interaction is required once a low-privilege account exists. Exploitation is trivial where the store allows open customer/subscriber registration, but this is a genuine-but-low-priority issue: there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is 0.19% (8th percentile).
Unauthenticated attackers can read product data that should be hidden - password-protected, private, and draft WooCommerce products - on any WordPress site running the WPC Smart Quick View for WooCommerce plugin in all versions up to and including 4.2.5. The flaw is an access-control weakness in the plugin's 'woosq_quickview' AJAX endpoint, which does not sufficiently restrict which posts it will render, so a caller can supply the identifier of a non-public product and receive its content; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is limited to confidentiality of product records - no writes, no account takeover, and no access to non-product content - and there is no public exploit code and no confirmed active exploitation at time of analysis, with EPSS at 0.34% (25th percentile).
Unauthenticated SQL injection in the PPOM - Product Addons & Custom Fields for WooCommerce plugin (versions up to and including 33.0.15) allows remote attackers to extract sensitive database information via the PPOM_Meta::get_fields_by_id() function. Exploitation requires the non-default 'Enable Legacy Price Calculations' setting to be enabled, significantly limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can tamper with WooCommerce order status and transaction IDs on stores running the Oceanpayment CreditCard Gateway plugin versions up to and including 6.0 because the plugin's return_payment and notice_payment functions lack authentication and capability checks. This is a remote, unauthenticated issue with only integrity impact (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N); EPSS is low at 0.34%, and no public exploit identified at time of analysis. The practical risk is low-to-moderate and limited to sites that actively use this specific WooCommerce gateway, where exploitation can disrupt order workflows and corrupt transaction records.
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
WooCommerce is an open-source e-commerce platform built on WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.6.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.8.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.2.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.1.3. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.8.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.9.40. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.9.50. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.7.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.1.1; WooCommerce Blocks:. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in Woo WooCommerce Product Add-ons woocommerce-product-addons.1.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Woo AutomateWoo automatewoo.7.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Woo WooCommerce Product Recommendations woocommerce-product-recommendations.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Woocommerce is an open source eCommerce plugin for WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WooCommerce before 3.5.5 allows XSS via a Photoswipe caption. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 42.9%.
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stored cross-site scripting in VillaTheme Email Template Customizer for WooCommerce (versions up to and including 1.2.17) allows an authenticated high-privilege user to inject malicious JavaScript into email template fields, which then executes in the browser of another user who views the affected template. The flaw requires both elevated privileges (PR:H) and victim interaction (UI:R), and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.18%).
Unauthenticated blind SQL injection in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin (all versions up to and including 1.3.7.1) allows a remote attacker to append arbitrary SQL to the text-search query via the `phrase` parameter and read sensitive data from the site's database through blind extraction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms no authentication, no privileges and no user interaction are required, and impact is confined to confidentiality with no integrity or availability effect. Real-world risk is constrained by a product-specific precondition (the plugin, and its by_text_2 text-phrase filter, must be installed, active and reachable) and by weak exploitation signals: EPSS is only 0.35% (26th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Product Filter by WBW (slug woo-product-filter) affects all versions up to and including 2.9.7, allowing remote attackers to inject arbitrary SQL through the 'filtersDataBackend' parameter and read sensitive data from the site's database. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication, no privileges, and no user interaction - any public-facing WordPress site with the vulnerable plugin active is directly exposed, with confidentiality impact rated High and no integrity or availability impact. There is no public exploit code identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.39% (31st percentile), but given the trivial unauthenticated access path this remains a genuine, actionable priority for any site running the affected plugin.
Cross-Site Request Forgery (CSRF) in the WooCommerce Simple Registration plugin for WordPress (versions up to and including 1.5.8) allows unauthenticated attackers to approve pending role requests and escalate user privileges by tricking an authenticated site administrator into clicking a crafted link. The flaw is missing nonce validation in the role-approval handler, and exploitation requires an existing pending role request plus administrator interaction, making it conditional rather than opportunistic. No public exploit has been identified, and the EPSS score is low (0.20%, 9th percentile).
Incorrect authorization in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.8.4) lets an authenticated user with Editor-level capabilities or higher reach the plugin's license-management routes and activate or deactivate the site's license without proper permission checks. The flaw is confined to license state manipulation - there is no path to code execution or data disclosure - and the vendor shipped a fix in version 4.8.5. No active exploitation is indicated (not in CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is 0.22% (12th percentile), consistent with a low-severity, low-real-risk issue.
Reflected cross-site scripting in the VNPAY Payment Gateway plugin for WordPress (slug vnpay-for-woocommerce) versions up to and including 1.0.0 lets remote attackers inject arbitrary script through the 'message' parameter handled by the Thankyou shortcode. Exploitation is not autonomous: per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker authentication is required, but a victim must be socially engineered into clicking a crafted link before the non-persistent payload executes in their browser. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.22% (11th percentile), so this reads as a genuine but low-priority issue rather than a critical one.
PHP object injection in the Acowebs Product Table For WooCommerce plugin (affected through version 1.2.4) lets an authenticated attacker supply serialized PHP data that the plugin passes to unserialize(), potentially leading to arbitrary object instantiation within the WordPress process. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) and requires a valid low-privilege WordPress session - such as a subscriber or WooCommerce customer account on stores that permit open registration; concrete impact such as file deletion, data exfiltration, or remote code execution depends on the presence of a usable POP gadget chain in WordPress core, WooCommerce, or installed themes/plugins, which is not confirmed in the source data. No public exploit identified at time of analysis, the issue does not appear in CISA KEV, and EPSS is 0.52% (42nd percentile), indicating low predicted exploitation activity at this time.
Privilege escalation in the extendons WooCommerce Registration Fields Plugin - Custom Signup Fields (slug extendons-registration-fields) at versions up to and including 3.2.3 allows an authenticated low-privilege user - for example a self-registered WooCommerce customer or subscriber, which is trivial to obtain on stores with open registration - to escalate their account to administrator over the network with no user interaction. The defect is an incorrect privilege assignment (CWE-266) in the plugin's custom signup/registration field handling, and because the resulting administrator role grants full content, configuration and user control, confidentiality, integrity and availability impacts are all rated high. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.39% (31st percentile), so this is a credible, actionable priority rather than an inflated CVSS score, contingent on the plugin being installed and active and on the attacker being able to register an account.
ShopMagic for WooCommerce, a WordPress marketing-automation plugin, embeds sensitive information into data it sends out in versions through 4.5.6, letting unauthenticated remote attackers retrieve that embedded data. The Patchstack-assigned CVSS 3.1 base score is 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), while our independent assessment scores it 5.3 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N because the scope-change is not clearly justified; the CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are required. EPSS is low at 0.31% (22nd percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis. Impact is limited to disclosure of a modest amount of sensitive data, with no integrity or availability effect, but exploitation requires a WooCommerce site running the vulnerable plugin version.
Reflected cross-site scripting in the WC Return products WordPress plugin (all versions up to and including 1.5) allows remote attackers to execute arbitrary script in a victim's browser session by luring that victim to a crafted URL whose input is reflected unsanitized into a page the plugin generates. Per the authoritative assessment (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker-side authentication is required (PR:N) but exploitation hinges on victim interaction (UI:R), so the attacker cannot trigger execution autonomously and impact is bounded by the clicking victim's session privileges. Only sites with the plugin installed and active are reachable via this code path; EPSS is low (0.25%, 15th percentile), the flaw is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin Finale Lite (sold as 'finale-woocommerce-sales-countdown-timer-discount') affects all versions up to and including 2.20.0, letting an attacker reflect unsanitized input back to a victim's browser through the vulnerable plugin endpoint. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), no authentication is required to deliver a payload, but successful exploitation depends on tricking a user into clicking a crafted link or submitting crafted input into a page that echoes it back. There is no public exploit identified at time of analysis and no CISA KEV listing, though the plugin's WooCommerce/e-commerce footprint makes administrative sessions a valuable target; sites running the plugin should treat this as a moderate, interaction-dependent risk.
Reflected cross-site scripting in the extendons WooCommerce Registration Fields plugin - Custom Signup Fields (extendons-registration-fields) for WordPress, affecting all versions through 3.2.3, allows remote attackers to inject and execute arbitrary script in the browser of a user who opens a crafted link. Exploitation is unauthenticated from the attacker's side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but depends on social engineering, since each victim must be lured into opening the malicious URL; impact is confined to the victim's browser session within the WordPress site's origin rather than to the server or host. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.28% (19th percentile), making this a moderate-priority patch item rather than an emergency.
Reflected cross-site scripting in the WordPress plugin WooCommerce Vehicle Parts Finder (versions up to and including 3.7) lets remote attackers inject script into a page generated from unsanitized input, which executes in the browser of any user who opens a crafted link. Exploitation requires victim interaction - the attacker only delivers a URL, so a site administrator or shop manager with an active logged-in session is the highest-value target, and the plugin's narrow install base further limits real-world impact. Risk signals are low: EPSS is 0.23% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; no vendor-released patch was identified in the available data, so the Patchstack advisory should be monitored for a fixed release even though patching guidance is not yet confirmed.
Stored cross-site scripting (XSS) in the WPC Countdown Timer for WooCommerce plugin (versions up to and including 3.1.4) enables an authenticated attacker with low-level privileges to inject malicious JavaScript into countdown timer settings. The payload executes in the browser of any user who views the affected page, potentially allowing session theft or defacement. No public exploit code has been identified and the EPSS score is low (0.20%), but the plugin's use in e-commerce sites warrants prompt patching per the Patchstack advisory.
Authenticated WordPress users with subscriber-level privileges or above can submit refund requests against arbitrary WooCommerce orders they do not own in the Flexible Refund and Return Order for WooCommerce plugin through version 1.0.38, because the save_refund_request() function performs no ownership or authorization check on the supplied order identifier (CWE-639). The impact is integrity-only - unauthorized refund requests are created in the store's workflow, but there is no confidentiality or availability impact, and no administrative access or user interaction is required once a low-privilege account exists. Exploitation is trivial where the store allows open customer/subscriber registration, but this is a genuine-but-low-priority issue: there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is 0.19% (8th percentile).
Unauthenticated attackers can read product data that should be hidden - password-protected, private, and draft WooCommerce products - on any WordPress site running the WPC Smart Quick View for WooCommerce plugin in all versions up to and including 4.2.5. The flaw is an access-control weakness in the plugin's 'woosq_quickview' AJAX endpoint, which does not sufficiently restrict which posts it will render, so a caller can supply the identifier of a non-public product and receive its content; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is limited to confidentiality of product records - no writes, no account takeover, and no access to non-product content - and there is no public exploit code and no confirmed active exploitation at time of analysis, with EPSS at 0.34% (25th percentile).
Unauthenticated SQL injection in the PPOM - Product Addons & Custom Fields for WooCommerce plugin (versions up to and including 33.0.15) allows remote attackers to extract sensitive database information via the PPOM_Meta::get_fields_by_id() function. Exploitation requires the non-default 'Enable Legacy Price Calculations' setting to be enabled, significantly limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can tamper with WooCommerce order status and transaction IDs on stores running the Oceanpayment CreditCard Gateway plugin versions up to and including 6.0 because the plugin's return_payment and notice_payment functions lack authentication and capability checks. This is a remote, unauthenticated issue with only integrity impact (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N); EPSS is low at 0.34%, and no public exploit identified at time of analysis. The practical risk is low-to-moderate and limited to sites that actively use this specific WooCommerce gateway, where exploitation can disrupt order workflows and corrupt transaction records.
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
WooCommerce is an open-source e-commerce platform built on WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.6.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.8.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.2.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.1.3. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.8.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.9.40. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.9.50. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.7.1. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.1.1; WooCommerce Blocks:. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in Woo WooCommerce Product Add-ons woocommerce-product-addons.1.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Woo AutomateWoo automatewoo.7.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Woo WooCommerce Product Recommendations woocommerce-product-recommendations.3.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Woocommerce is an open source eCommerce plugin for WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WooCommerce before 3.5.5 allows XSS via a Photoswipe caption. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 42.9%.
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.