Vulnerability Description
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Woocommerce | Woocommerce | < 9.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/woocommerce/woocommerce/pull/49370Patch
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&newPatch
- https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/changelog.txtRelease Notes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a63Third Party Advisory
FAQ
What is CVE-2024-9944?
CVE-2024-9944 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order...
How severe is CVE-2024-9944?
CVE-2024-9944 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-9944?
Check the references section above for vendor advisories and patch information. Affected products include: Woocommerce Woocommerce.