WooCommerce < 9.1.4 – Stored XSS | CVE 2024-39666 | Plugin Vulnerabilities

Description

The plugin does not escape the value of its product add_to_cart_text() method, which can contain user input via the woocommerce_product_add_to_cart_text filter. WooCommerce is not directly vulnerable, however this could lead to Stored Cross-Site Scripting issues when another plugin/theme exposes such filter to user input.

Proof of Concept

Using a plugin such as Code Snippets and add the following code:

add_filter( 'woocommerce_product_add_to_cart_text', 'custom_add_to_cart_text' );

function custom_add_to_cart_text( $default ) {
    global $product;
    return "Add to Cart'id='x'tabindex='1'autofocus=''onfocus='alert(`XSS`)'x='";
}

Affects Plugins

Fixed in 9.1.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

stealthcopter

Submitter

stealthcopter

Submitter website

https://sec.stealthcopter.com

Submitter twitter

Verified

Yes

WPVDB ID

d72df81e-c0e8-4705-8bd1-67a71f78a47e

Timeline

Publicly Published

2024-07-24 (about 1 year ago)

Added

2024-07-26 (about 1 year ago)

Last Updated

2024-08-22 (about 1 year ago)

Other

Published

Title

Published

2024-07-10

Title

WANotifier < 2.6.1 - Admin+ Stored XSS

Published

2024-09-30

Title

123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting

Published

2014-08-01

Title

LBG Zoominoutslider - settings_form.php Multiple Parameter Stored XSS

Published

2024-03-29

Title

Post-Plugin Library <= 2.6.2.1 - Reflected Cross-Site Scripting

Published

2024-11-20

Title

Advance Post Prefix <= 1.1.1 - Reflected XSS