CVE-2022-2099: Stored HTML Injection in WooCommerce WordPress Plugin
Summary
CVE-2022-2099: WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection. Affects woocommerce/woocommerce versions < 6.6.0. Fixed in 6.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The WooCommerce WordPress plugin is a popular e-commerce solution that allows users to create online stores and manage their products, orders, and payments. It is widely used by businesses and individuals to set up and run their online shops. The plugin provides various features such as product management, inventory tracking, payment gateway integration, and order fulfillment. However, prior to version 6.6.0, the plugin is vulnerable to stored HTML injection due to a lack of escaping and sanitizing in the payment gateway titles.
Vulnerability Detail
The vulnerability in the WooCommerce WordPress plugin allows an attacker to inject malicious HTML code into the payment gateway titles. This can lead to various security risks, including cross-site scripting (XSS) attacks and the potential for unauthorized access to sensitive information. An attacker could exploit this vulnerability by crafting a specially crafted payment gateway title that contains malicious HTML code. When a user views the payment gateway selection page or any other page that displays the payment gateway titles, the injected HTML code would be executed in the user's browser, potentially leading to the execution of arbitrary JavaScript code or the theft of sensitive data.
How To Fix
Minimum fixed version
6.6.0
This is the first release that contains the fix.
composer require woocommerce/woocommerce:6.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The WooCommerce WordPress plugin prior to version 6.6.0 is vulnerable to stored HTML injection, which can lead to cross-site scripting attacks and unauthorized access to sensitive information. Users should update to the latest version of the plugin to fix this vulnerability and ensure the security of their online stores. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for woocommerce/woocommerce →
FAQ
The vulnerability allows an attacker to inject malicious HTML code into the payment gateway titles, potentially leading to cross-site scripting (XSS) attacks and unauthorized access to sensitive information.
There is currently no known exploit for this vulnerability. However, it is important to apply the necessary security updates to prevent any potential exploitation.
No, only versions prior to 6.6.0 are affected. Users should update to the latest version to mitigate the vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious HTML code into the payment gateway titles, which will be executed in the user's browser when they view the affected pages.
No, the only way to fully mitigate this vulnerability is to update the WooCommerce plugin to version 6.6.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for woocommerce/woocommerce.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
