CVE-2021-24323: Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled
Summary
CVE-2021-24323: Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled. Affects woocommerce/woocommerce versions < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Woocommerce is an open-source e-commerce plugin for WordPress. It provides a platform for creating online stores and managing products, orders, and payments. The plugin allows users to customize their online stores by adding various functionalities and extensions. However, a vulnerability has been discovered in Woocommerce that allows high privilege users, such as admins, to execute cross-site scripting (XSS) attacks through the 'Additional tax classes' field when taxes are enabled.
Vulnerability Detail
The 'Additional tax classes' field in Woocommerce was not properly sanitized or escaped before being output in the admin dashboard. This allowed high privilege users to inject malicious scripts into the field, which would then be executed when viewed by other users. Even if the 'unfiltered_html' capability was disabled for the user, they could still exploit this vulnerability. The impact of this vulnerability includes potential data theft, session hijacking, and the ability to perform actions on behalf of other users. The vulnerability has a CVSS score of 4.8.
How To Fix
Minimum fixed version
5.2.0
This is the first release that contains the fix.
composer require woocommerce/woocommerce:5.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Woocommerce as soon as possible.
Conclusion
The Woocommerce plugin is vulnerable to a cross-site scripting (XSS) attack through the 'Additional tax classes' field when taxes are enabled. This vulnerability allows high privilege users to inject malicious scripts, potentially leading to data theft and unauthorized actions. Users should update their Woocommerce installation to version 5.2.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for woocommerce/woocommerce →
FAQ
Woocommerce is an open-source e-commerce plugin for WordPress that allows users to create online stores and manage products, orders, and payments.
The vulnerability allows high privilege users to execute cross-site scripting attacks, potentially leading to data theft, session hijacking, and unauthorized actions on behalf of other users.
Users of Woocommerce versions prior to 5.2.0 are affected by this vulnerability.
No, there is no known workaround. It is recommended to update to the latest version of Woocommerce.
To update Woocommerce, you can go to the WordPress admin dashboard, navigate to the 'Plugins' section, find Woocommerce in the list of installed plugins, and click the 'Update Now' button.
Related vulnerabilities
Recent vulnerabilities recorded for woocommerce/woocommerce.
