Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)

Vulnerability

The Advanced Order Export For WooCommerce plugin for WordPress versions before 3.1.8 contains a reflected cross-site scripting (XSS) vulnerability in the tab parameter of the admin panel. The plugin fails to properly sanitize user input before outputting it, allowing an attacker to inject malicious JavaScript code. This vulnerability is classified as CWE-79 and has a CVSS score of 8.3 (high) [1].

Exploitation

An attacker must have authenticated access to the WordPress admin panel (e.g., as a shop manager or administrator). The attacker can craft a URL with a malicious payload in the tab parameter and trick an authenticated user into clicking it. No special privileges beyond authentication are required, and the attack does not require user interaction beyond the victim clicking the crafted link [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's admin session. This can lead to theft of session cookies, defacement of the admin interface, or further actions such as creating new admin users or modifying plugin settings. The impact is limited to the admin panel and does not affect site visitors directly [1].

Mitigation

The vulnerability is fixed in version 3.1.8 of the plugin. Users should update to this version or later immediately. No workarounds are available. The plugin vendor released the fix on an undisclosed date prior to the public disclosure on 2021-03-03 [1].