Prior to version 3.3.1 of WooCommerce, the callback referenced in the fatal error message for transaction emails was not properly escaped, potentially leading to XSS.
This vulnerability affects the following application versions:
- WooCommerce 3.0.2
- WooCommerce 3.0.3
- WooCommerce 3.0.4
- WooCommerce 3.0.5
- WooCommerce 3.0.6
- WooCommerce 3.0.7
- WooCommerce 3.0.8
- WooCommerce 3.0.9
- WooCommerce 3.1.0
- WooCommerce 3.1.0-rc.1
- WooCommerce 3.1.0-rc.2
- WooCommerce 3.1.1
- WooCommerce 3.1.2
- WooCommerce 3.2.0
- WooCommerce 3.2.0-rc.1
- WooCommerce 3.2.0-rc.2
- WooCommerce 3.2.1
- WooCommerce 3.2.2
- WooCommerce 3.2.3
- WooCommerce 3.2.4
- WooCommerce 3.2.5
- WooCommerce 3.2.6
- WooCommerce 3.3.0
- WooCommerce 3.3.0-rc.1
- WooCommerce 3.3.0-rc.2