The save_data() AJAX call, used by unauthenticated users, such as guest during the checkout process, does not sanitise or validate user input (for example billing_first_name, billing_last_name, and billing_company fields). This leads to a Stored Cross-Site Scripting issue which will be triggered in the admin dashboard.
Ryan Dewhurst
No
2019-03-11 (about 4 years ago)
2019-03-11 (about 4 years ago)
2020-11-08 (about 2 years ago)