CVE-2021-25077

CVE-2021-25077: Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

Vendor Unknown

Product Store Toolkit for WooCommerce

Weakness CWE-79 · XSS

Published February 7, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting

Key dates

02Disclosure timeline

February 7, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-25077 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values CVE-2026-16786 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode