CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.
Explanation of Vulnerability in Simple Terms
WooCommerce versions up to 10.0.2 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires user interaction and affects the site's integrity and confidentiality. Sites running affected versions should update to a version newer than 10.0.2.
What an attacker can do
An authenticated admin can inject malicious scripts that execute in other users' browsers when they visit affected pages.
Potential impact on your site
Admins with malicious intent can compromise other users' sessions, steal data, or modify site content via stored XSS.
Conditions required to exploit
Attacker must have administrator privileges and the victim must visit a page containing the injected script.
Key dates
External resources
Related vulnerabilities
