WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
Description
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the Sourcebuster.js library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
woocommerce/woocommercePackagist | >= 8.8.0, < 8.8.5 | 8.8.5 |
woocommerce/woocommercePackagist | >= 8.9.0, < 8.9.3 | 8.9.3 |
Affected products
2- Range: >= 8.8.0, < 8.8.5
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-cv23-q6gh-xfrfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-37297ghsaADVISORY
- developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0ghsax_refsource_MISCWEB
- github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4ghsax_refsource_MISCWEB
- github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67ghsax_refsource_MISCWEB
- github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrfghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.