CVE Database /
CVE-2024-9944
CVE · Medium
CVE-2024-9944 — WooCommerce [woocommerce] < 9.1.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-9944
|
WooCommerce [woocommerce] < 9.1.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 9.1.0
|
9.1.0 |
2024-10-14 |
—
|
CVE-2024-9944
WooCommerce's handling of user-submitted data in WordPress has a flaw, allowing malicious code to be injected into order forms across versions 9.0.2 and below. The issue arises from insufficient sanitization of HTML elements within these submissions, enabling unauthenticated attackers to embed arbitrary code that will display when administrators review the orders.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings