WordPress Plugin Vulnerabilities

Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)

Description

The Advanced Order Export plugin for WooCommerce versions < 3.1.4 had a reflected XSS vulnerability due to lack of input sanitization on the woe_post_type parameter. This allowed arbitrary HTML and JavaScript injection and execution in the context of the logged in user.

Proof of Concept

Affects Plugins

Plugin icon
woo-order-export-lite
Fixed in 3.1.4

References

CVE
CVE-2020-11727
URL
https://www.themissinglink.com.au/security-advisories-cve-2020-11727
URL
https://plugins.trac.wordpress.org/changeset/2283137/woo-order-export-lite

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Jack Misiura
Submitter
Jack Misiura
Submitter website
https://www.themissinglink.com.au
Verified
No
WPVDB ID
db7b6799-99fd-4376-8da4-84885d17b387

Timeline

Publicly Published
2020-05-04 (about 6 years ago)
Added
2020-05-04 (about 6 years ago)
Last Updated
2020-05-05 (about 6 years ago)

Other

Published
Title
Published
2026-03-18
Title
SlimStat Analytics < 5.4.0 - Unauthenticated Stored Cross-Site Scripting via 'fh'
Published
2023-01-24
Title
Youzify < 1.2.2 - Contributor+ Stored XSS
Published
2024-06-06
Title
Link Library < 7.6.4 - Reflected Cross-Site Scripting
Published
2025-09-29
Title
dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2017-09-02
Title
SmokeSignal <= 1.2.6 - Authenticated Stored XSS