CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9944 – WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
https://notcve.org/view.php?id=CVE-2024-9944
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions. • https://github.com/woocommerce/woocommerce/pull/49370 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3115837%40woocommerce%2Ftrunk&old=3106873%40woocommerce%2Ftrunk&sfp_email=&sfph_mail= https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/changelog.txt https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-2069 – WooCommerce <= 2.2.10 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2069
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php. Vulnerabilidad de XSS en el plugin WooCommerce anterior a 2.2.11 para WordPress permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de QUERY_STRING en la página wc-reports en wp-admin/admin.php. • http://packetstormsecurity.com/files/130458/WordPress-WooCommerce-2.2.10-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Feb/75 http://www.securityfocus.com/bid/74885 https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 16EXPL: 1CVE-2014-6313 – WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter
https://notcve.org/view.php?id=CVE-2014-6313
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php. Vulnerabilidad de XSS en el plugin WooCommerce anterior a 2.2.3 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro range en la página wc-reports en wp-admin/admin.php. • http://seclists.org/fulldisclosure/2014/Sep/59 http://secunia.com/advisories/61377 https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •