WordPress Plugin Vulnerabilities

WooCommerce < 9.1.0 - Unauthenticated HTML Injection

Description

The plugin for WordPress is vulnerable to HTML Injection due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.

Affects Plugins

Plugin icon
woocommerce
Fixed in 9.1.0

References

CVE
CVE-2024-9944
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
drop
Verified
Yes
WPVDB ID
ccef1e59-40df-4645-aacb-4bb9c4b96456

Timeline

Publicly Published
2024-10-14 (about 1 year ago)
Added
2024-10-15 (about 1 year ago)
Last Updated
2024-10-15 (about 1 year ago)

Other

Published
Title
Published
2023-12-19
Title
WooCommerce Menu Extension <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-04
Title
Embed Chessboard <= 3.08.00 - Contributor+ Stored XSS
Published
2025-09-03
Title
TheGem (Elementor) < 5.10.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-03-23
Title
Shortcodes Ultimate < 7.0.5 - Contributor+ Stored Cross-Site Scripting via 'note_color' Shortcode
Published
2018-01-12
Title
Read and Understood <= 2.1 - Authenticated Stored XSS & CSRF