WordPress Plugin Vulnerabilities

WooCommerce < 2.2.3 - Reflected Cross-Site Scripting (XSS)

Description

The WooCommerce WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
woocommerce
Fixed in 2.2.3

References

URL
https://seclists.org/fulldisclosure/2014/Sep/59
URL
https://advisories.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
pvdl
Verified
No
WPVDB ID
a2cc949c-838f-4e47-9ee8-07e3fb3cb049

Timeline

Publicly Published
2014-09-21 (about 11 years ago)
Added
2014-09-21 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2022-05-26
Title
Image Slider by NextCode <= 1.1.2 - Author+ Stored Cross-Site Scripting
Published
2022-05-04
Title
Checkout Files Upload for WooCommerce < 2.1.3 - Reflected Cross-Site Scripting
Published
2025-09-26
Title
Smart Related Products <= 2.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-01-18
Title
Better Font Awesome < 2.0.4 - Contributor+ Stored XSS
Published
2025-12-04
Title
WP-SOS-Donate Donation Sidebar Plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']