CVE-2024-37297

WooCommerce versions starting from 8.8 contain a reflected cross-site scripting vulnerability where attackers can craft malicious links with injected HTML and JavaScript that gets processed by the Sourcebuster.js library and inserted unsanitized into classic checkout and registration forms. Although the malicious code is not persisted in the database, victims who click such links could have their browser data and session information compromised. The vulnerability has been fixed in versions 8.8.5 and 8.9.3, with an alternative mitigation available by disabling the Order Attribution feature.

Based on public CVE data (MITRE/NVD).