What the vulnerability does
01Description
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
Explanation of Vulnerability in Simple Terms
02Summary
WooCommerce versions 8.8.0 through 8.8.4 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level access can craft a request that, when visited by another user, executes arbitrary JavaScript in their browser. The vulnerability affects the site's integrity and can expose user data or session tokens.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in other users' browsers to steal data or hijack sessions.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other visitors; customer data and admin sessions are at risk.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; victim must visit a page containing the malicious payload.
Key dates
06Disclosure timeline
June 12, 2024
CVE published
August 2, 2024
Record updated
