CVE-2023-47777

WooCommerce versions through 8.1.1 contain a stored cross-site scripting vulnerability that allows authenticated users with contributor-level permissions to inject malicious scripts through the featured image alt attribute. The vulnerability results from inadequate sanitization of user input and insufficient escaping during output, enabling attackers to execute arbitrary JavaScript when other users view affected pages. The same flaw is present in WooCommerce Blocks plugin up to version 11.1.1. The issue is resolved in WooCommerce version 8.2.0 and later.

Based on public CVE data (MITRE/NVD).