An attacker able to convince a logged-in admin user to visit a link of their choosing could execute arbitrary JavaScript within the admin’s browser.
This vulnerability affects the following application versions:
- WooCommerce 2.1.0
- WooCommerce 2.1.0-RC1
- WooCommerce 2.1.0-RC2
- WooCommerce 2.1.1
- WooCommerce 2.1.2
- WooCommerce 2.1.3
- WooCommerce 2.1.4
- WooCommerce 2.1.5
- WooCommerce 2.1.6
- WooCommerce 2.1.7
- WooCommerce 2.1.8
- WooCommerce 2.1.9
- WooCommerce 2.1.10
- WooCommerce 2.1.11
- WooCommerce 2.1.12
- WooCommerce 2.2.0
- WooCommerce 2.2.0-RC1
- WooCommerce 2.2.1
- WooCommerce 2.2.2