WordPress Plugin Vulnerabilities

WooCommerce Subscriptions < 2.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

Description

An unauthenticated user could put XSS payload in their billing details when subscribing, which will then be executed in the admin dashboard when moused over.

Affects Plugins

Plugin icon
woocommerce-subscriptions
Fixed in 2.6.3

References

CVE
CVE-2019-18834

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
9.6 (critical)

Miscellaneous

Original Researcher
precursorsecurity
Verified
No
WPVDB ID
1021be31-4a35-4ff3-a7bc-00da607c2fe0

Timeline

Publicly Published
2020-07-24 (about 5 years ago)
Added
2020-07-24 (about 5 years ago)
Last Updated
2020-07-25 (about 5 years ago)

Other

Published
Title
Published
2025-01-16
Title
LikeBot – Decentralized like-system <= 0.85 - Admin+ Stored XSS via CSRF
Published
2015-03-07
Title
FormGet Contact Form 5.3 - Stored XSS
Published
2024-04-26
Title
Nextgen Gallery < 3.59.1 - Admin+ Stored XSS
Published
2024-01-19
Title
PDF Viewer & 3D PDF Flipbook – DearPDF <= 2.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-10
Title
TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting