CVE-2022-50941 MEDIUM

CVE-2022-50941: BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout

Vendor Mrplugins
Product BootCommerce
Weakness CWE-79 · XSS
Published February 1, 2026
Last update February 3, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkout input fields. Attackers can exploit unvalidated input parameters to execute arbitrary scripts, potentially leading to session hijacking, phishing attacks, and application module manipulation.

Key dates

02Disclosure timeline

February 1, 2026 CVE published
February 3, 2026 Record updated

Related vulnerabilities

04Related CVE