WooCommerce Archives - Standoutmedia A/S

CSRF Logout via customer-logout Endpoint

Skrevet den 12. maj 2026 af i WooCommerce

WooCommerce versions prior to 9.3.0 are affected by a Cross-Site Request Forgery vulnerability in the customer-logout endpoint. An unauthenticated attacker can force a logged-in user to be logged out by directing them to /my-account/customer-logout/, which processed the logout without verifying a nonce. Additionally, navigation menu logout links in both classic and block themes were rendered without nonces, providing ready-made CSRF targets. The fix in wc_template_redirect() now strictly requires a valid customer-logout nonce via wp_verify_nonce() before calling wp_logout(), falling back to a confirmation prompt when the nonce is missing, and the wc_nav_menu_items() and new wc_nav_menu_inner_blocks() functions inject nonces into all logout links automatically.

This vulnerability affects the following application versions:

Prevent stored XSS on order notes added via REST API

Skrevet den 1. april 2026 af i WooCommerce

Prevent stored XSS on order notes added via REST API

This vulnerability affects the following application versions:

Store API Guest Order Data Exposure

Skrevet den 3. februar 2026 af i WooCommerce

A critical vulnerability was discovered in WooCommerce (versions 8.1 to 10.4.2) that, if exploited, could allow logged-in customers to access order details belonging to guest customers. This vulnerability affected the WooCommerce Store API and has the potential to expose customer order information. We currently have no evidence of the vulnerability being used or exploited outside of our own security testing progra

This vulnerability affects the following application versions:

Sanitize input in admin report queries to prevent potential SQL injection.

Skrevet den 18. august 20255. marts 2026 af i WooCommerce

Improved the use of filters in get_order_report_data() by applying $wpdb->prepare() for safer handling of parameters like coupon_codes which could lead to potential sql injection.

This vulnerability affects the following application versions:

Improved Permission Checks in Admin API Endpoints

Skrevet den 15. april 20255. marts 2026 af i WooCommerce

This security update strengthens permission validation in several WooCommerce Admin API endpoints by ensuring that only authorized users can perform sensitive actions such as updating settings or deleting data via batch operations. The changes introduce explicit current_user_can() checks to prevent potential unauthorized access and align with WordPress capability standards.

This vulnerability affects the following application versions:

XSS on wc-cart page

Skrevet den 4. marts 20255. marts 2026 af i WooCommerce

Validate and sanitize the event origin and event data when listening to message events from attachParentListeners function to prevent xss attacks during the customize your store flow

This vulnerability affects the following application versions:

XSS in the Address schema

Skrevet den 24. april 20245. marts 2026 af i WooCommerce

Attackers are able to inject client-side scripts into web pages viewed by other users.

This vulnerability affects the following application versions:

WooCommerce 8.5.0
WooCommerce 8.5.0-beta.1
WooCommerce 8.5.0-rc.1
WooCommerce 8.5.1
WooCommerce 8.5.2
WooCommerce 8.5.3
WooCommerce 8.5.4
WooCommerce 8.5.5
WooCommerce 8.6.0
WooCommerce 8.6.0-beta.1
WooCommerce 8.6.0-rc.1
WooCommerce 8.6.1
WooCommerce 8.6.2
WooCommerce 8.6.3
WooCommerce 8.6.4

Incorrect permission while setting the source type and origin of order

Skrevet den 16. april 202418. oktober 2025 af i WooCommerce

For ajax requests, bail if the referer is not an admin.

This vulnerability affects the following application versions:

WooCommerce 8.5.0
WooCommerce 8.5.0-beta.1
WooCommerce 8.5.0-rc.1
WooCommerce 8.5.1
WooCommerce 8.5.2
WooCommerce 8.6.0
WooCommerce 8.6.0-beta.1
WooCommerce 8.6.0-rc.1
WooCommerce 8.6.1

XSS in the Address and checkout schema

Skrevet den 16. april 202418. april 2024 af i WooCommerce

Sanitizes the array items using wp_kses()

This vulnerability affects the following application versions:

XSS in the helper page

Skrevet den 20. februar 20245. marts 2026 af i WooCommerce

The helper page of the WooCommerce is not properly sanitized against an XSS attack.

This vulnerability affects the following application versions:

Improper access in the admin status

Skrevet den 20. februar 20245. marts 2026 af i WooCommerce

Fixes permission issues when flushing all logs or bulk deleting logs from the database.

This vulnerability affects the following application versions:

WooCommerce 8.4.0
WooCommerce 8.4.0-beta.1
WooCommerce 8.4.0-rc.1
WooCommerce 8.4.1
WooCommerce 8.4.2
WooCommerce 8.4.3

XSS in the admin assests

Skrevet den 14. februar 202418. oktober 2025 af i WooCommerce

Prevents XSS vulnerability in the admin assets by stripping all tags.

This vulnerability affects the following application versions:

WooCommerce 8.5.0
WooCommerce 8.5.0-beta.1
WooCommerce 8.5.0-rc.1

XSS in the ProductReviews

Skrevet den 25. januar 20245. marts 2026 af i WooCommerce

The ProductReview is not properly sanitized for XSS attacks.

This vulnerability affects the following application versions:

XSS in woocommerce blocks

Skrevet den 7. september 20235. marts 2026 af i WooCommerce

The woocommerce blocks while adding an a query assest is not properly escaped against an XSS attack.

This vulnerability affects the following application versions:

Incorrect permissions at the REST API endpoint

Skrevet den 5. juni 20235. marts 2026 af i WooCommerce

The REST API endpoint is not checked properly for permissions.

This vulnerability affects the following application versions:

XSS in the WooCommerce block types

Skrevet den 11. maj 20235. marts 2026 af i WooCommerce

The WooCommerce block types is not properly escaped against an XSS attack.

This vulnerability affects the following application versions:

WooCommerce 7.0.0
WooCommerce 7.0.0-beta.1
WooCommerce 7.0.0-beta.2
WooCommerce 7.0.0-beta.3
WooCommerce 7.0.0-rc.1
WooCommerce 7.0.0-rc.2
WooCommerce 7.0.1
WooCommerce 7.0.2
WooCommerce 7.1.0
WooCommerce 7.1.0-beta.1
WooCommerce 7.1.0-beta.2
WooCommerce 7.1.0-rc.1
WooCommerce 7.1.0-rc.2
WooCommerce 7.1.1
WooCommerce 7.1.2
WooCommerce 7.2.0
WooCommerce 7.2.0-beta.1
WooCommerce 7.2.0-beta.2
WooCommerce 7.2.0-rc.1
WooCommerce 7.2.0-rc.2
WooCommerce 7.2.1
WooCommerce 7.2.2
WooCommerce 7.2.3
WooCommerce 7.2.4

XSS in metabox customer note field

Skrevet den 28. marts 20235. marts 2026 af i WooCommerce

Some variables in the customer note field are not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

XSS in WC-Cart

Skrevet den 15. februar 20235. marts 2026 af i WooCommerce

The WC-cart is not properly sanitized to prevent object injection.

This vulnerability affects the following application versions:

XSS in the class meta-box

Skrevet den 16. december 20225. marts 2026 af i WooCommerce

The customer note in the meta-box is not adequately escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

XSS in meta box order data

Skrevet den 17. november 20225. marts 2026 af i WooCommerce

Some variables are not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

SQL injection in the taxes API

Skrevet den 12. september 20225. marts 2026 af i WooCommerce

The API taxes are not properly escaped to prevent an SQL injection.

This vulnerability affects the following application versions:

XSS in various modules

Skrevet den 1. juli 20225. marts 2026 af i WooCommerce

Some addons of WooCommerce are not properly escaped to prevent XSS attacks.

This vulnerability affects the following application versions:

Incorrect session handling

Skrevet den 19. maj 20225. marts 2026 af i WooCommerce

The session is not properly checked if it is expired or belongs to a logged-out user.

This vulnerability affects the following application versions:

Filtering and validating of CSV files to prevent XSS attack

Skrevet den 25. april 202220. november 2024 af i WooCommerce

The tax rate and product importer of CSV files were not properly filtered and validated against XSS.

`

This vulnerability affects the following application versions:

Permission check for reviews in v1 & v2 REST API

Skrevet den 29. marts 20225. marts 2026 af i WooCommerce

Missing boolean checks before the permission check can lead having wrong permissions for users

This vulnerability affects the following application versions:

Path traversal in admin importers

Skrevet den 28. marts 20225. marts 2026 af i WooCommerce

The CSV and TXT importers of taxes and products are not properly checked against path traversal attacks.

This vulnerability affects the following application versions:

XSS in the admin notices

Skrevet den 23. februar 20225. marts 2026 af i WooCommerce

The admin notice is not properly escaped against an XSS attack.

This vulnerability affects the following application versions:

Missing permission check for managing attachment image

Skrevet den 1. november 20215. marts 2026 af i WooCommerce

User isn’t correctly checked for permission when managing attachment image. This can lead to arbitrarily file uploading.

This vulnerability affects the following application versions:

XSS in several elements in the admin main view

Skrevet den 26. oktober 20215. marts 2026 af i WooCommerce

Several elements in the admin main view are not properly sanitized against XSS.

This vulnerability affects the following application versions:

Missing type casting in price elements

Skrevet den 25. oktober 20215. marts 2026 af i WooCommerce

Several price elements aren’t properly casted to their desired variable types which can lead to XSS

This vulnerability affects the following application versions:

XSS in the product object for the JSON search downloadable products

Skrevet den 13. september 20215. marts 2026 af i WooCommerce

The product object for the JSON search downloadable products wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added SQL sanitizing to search and attributes to prevent SQL injection

Skrevet den 16. juli 202120. november 2024 af i WooCommerce

The parameter for search webhook and attributes in the product filtering weren’t properly sanitized against SQL injection. This was a critical vulnerability.

This vulnerability affects the following application versions:

Escaping added to templates and classes and usage of absolute paths to prevent XSS

Skrevet den 17. maj 202120. november 2024 af i WooCommerce

Several elements and paths weren’t properly sanitized against XSS.

This vulnerability affects the following application versions:

Added escaping to data linked products to prevent XSS

Skrevet den 4. februar 202120. november 2024 af i WooCommerce

Data linked products weren’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to label in fields to prevent XSS

Skrevet den 9. december 202020. november 2024 af i WooCommerce

Some fields in labels weren’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to saving meta box data to prevent XSS

Skrevet den 17. november 202020. november 2024 af i WooCommerce

Meta box data wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to coupon id code to prevent XSS

Skrevet den 8. oktober 202020. november 2024 af i WooCommerce

The id of the coupon code wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to shop coupon post type to prevent XSS

Skrevet den 7. oktober 202020. november 2024 af i WooCommerce

Shop coupon wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

Added extra escaping to coupon code to prevent XSS

Skrevet den 6. oktober 202020. november 2024 af i WooCommerce

The coupon code was not properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to prepare attributes to prevent XSS

Skrevet den 13. august 202020. november 2024 af i WooCommerce

The attribute name in prepare attribute wasn’t properly escaped against XSS.

This vulnerability affects the following application versions:

Several include elements escaped to prevent XSS

Skrevet den 21. juli 202018. oktober 2025 af i WooCommerce

A range of include elements were not properly escaped to prevent XSS.

This vulnerability affects the following application versions:

Added escaping to several product elements to prevent XSS

Skrevet den 15. juli 202020. november 2024 af i WooCommerce

Some of the product elements weren’t properly escaped against. XSS.

This vulnerability affects the following application versions:

Adding escaping for ‘Featured Category’ and ‘Featured Product’ to prevent XSS

Skrevet den 11. maj 202020. november 2024 af i WooCommerce

‘Featured Category’ and ‘Featured Product’ were not properly escaped against XSS.

This vulnerability affects the following application versions:

WooCommerce 3.7.0
WooCommerce 3.7.0-beta.1
WooCommerce 3.7.0-rc.1
WooCommerce 3.7.0-rc.2
WooCommerce 3.7.1
WooCommerce 3.7.2
WooCommerce 3.7.3
WooCommerce 3.8.0
WooCommerce 3.8.0-beta.1
WooCommerce 3.8.0-rc.1
WooCommerce 3.8.0-rc.2
WooCommerce 3.8.1
WooCommerce 3.8.2
WooCommerce 3.8.3
WooCommerce 3.9.0
WooCommerce 3.9.0-beta.1
WooCommerce 3.9.0-beta.2
WooCommerce 3.9.0-rc.1
WooCommerce 3.9.0-rc.2
WooCommerce 3.9.0-rc.3
WooCommerce 3.9.0-rc.4
WooCommerce 3.9.1
WooCommerce 3.9.2
WooCommerce 4.0.0-beta.1
WooCommerce 4.0.0-rc.1

Escape added to coupon error messages to avoid XSS

Skrevet den 9. april 202020. november 2024 af i WooCommerce

Coupon exception messages were not properly escaped against XSS.

This vulnerability affects the following application versions:

Add escaping message for invalid coupon to prevent XSS

Skrevet den 26. februar 202020. november 2024 af i WooCommerce

Message was not properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to duplicate product action message to prevent XSS

Skrevet den 26. februar 202020. november 2024 af i WooCommerce

Duplicate product action message was not properly sanitized to avoid XSS.

This vulnerability affects the following application versions:

Added escaping for various items in the admin section to prevent XSS

Skrevet den 17. februar 202020. november 2024 af i WooCommerce

The product images, page addons, and table list logging were not properly escaped agains XSS.

This vulnerability affects the following application versions:

Added escaping for cross sell in cart to avoid XSS

Skrevet den 5. februar 202020. november 2024 af i WooCommerce

Cross sell in cart was not properly escaped against XSS.

This vulnerability affects the following application versions:

Added wp_redirect() to avoid unsafe redirects

Skrevet den 31. januar 202020. november 2024 af i WooCommerce

Redirects for disable author archives for customers were not safe.

This vulnerability affects the following application versions:

Added escaping to cart shipping to prevent XSS

Skrevet den 23. januar 202020. november 2024 af i WooCommerce

Address part was not properly escaped to prevent XSS.

This vulnerability affects the following application versions:

WooCommerce 3.5.0
WooCommerce 3.5.0-beta.1
WooCommerce 3.5.0-rc.1
WooCommerce 3.5.0-rc.2
WooCommerce 3.5.1
WooCommerce 3.5.2
WooCommerce 3.5.3
WooCommerce 3.5.4
WooCommerce 3.5.5
WooCommerce 3.5.6
WooCommerce 3.5.7
WooCommerce 3.5.8
WooCommerce 3.5.9
WooCommerce 3.5.10
WooCommerce 3.6.0
WooCommerce 3.6.0-beta.1
WooCommerce 3.6.0-rc.1
WooCommerce 3.6.0-rc.2
WooCommerce 3.6.0-rc.3
WooCommerce 3.6.1
WooCommerce 3.6.2
WooCommerce 3.6.3
WooCommerce 3.6.4
WooCommerce 3.6.5
WooCommerce 3.6.6
WooCommerce 3.6.7
WooCommerce list

Added escaping to cart totals to prevent XSS

Skrevet den 23. januar 202020. november 2024 af i WooCommerce

Various part in cart totals were not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping authentication header to prevent XSS

Skrevet den 16. januar 202020. november 2024 af i WooCommerce

Authentication header was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping multipart mail body to prevent XSS

Skrevet den 16. januar 202020. november 2024 af i WooCommerce

The plain replace part was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to backorder notification in cart to prevent XSS

Skrevet den 11. december 201920. november 2024 af i WooCommerce

Cart template was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added in review order to prevent XSS

Skrevet den 9. december 201920. november 2024 af i WooCommerce

The review order view was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to thank-you-page to prevent XSS

Skrevet den 9. december 201920. november 2024 af i WooCommerce

Thank-you-page was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added for new order to prevent XSS

Skrevet den 9. december 201920. november 2024 af i WooCommerce

When adding a new order the email template was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to the login form to prevent XSS

Skrevet den 5. december 201920. november 2024 af i WooCommerce

The login form was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to form pay to prevent XSS

Skrevet den 5. december 201920. november 2024 af i WooCommerce

Form pay message was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping fix for admin metaboxes viewing translation – 2

Skrevet den 27. november 201920. november 2024 af i WooCommerce

Data escaped and validated. Plus translator comment documentation added.

Official description: Admin metaboxes views translation escaping fix.

This vulnerability affects the following application versions:

Escaping plain email and my account section to prevent XSS

Skrevet den 20. november 201920. november 2024 af i WooCommerce

Plain email and my account sections were not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping the order, download and review sections to prevent XSS

Skrevet den 19. november 201920. november 2024 af i WooCommerce

The order, download and review sections were not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping order section to prevent XSS

Skrevet den 19. november 201920. november 2024 af i WooCommerce

The order section was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to empty cart message to prevent XSS

Skrevet den 7. november 201920. november 2024 af i WooCommerce

Mini-cart page was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added to the checkout coupon message to prevent XSS

Skrevet den 7. november 201920. november 2024 af i WooCommerce

The checkout coupon message was not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping of translatable strings in email templates to prevent XSS

Skrevet den 28. oktober 201920. november 2024 af i WooCommerce

The plain email content was not properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping and sanitized to coupon code and note to prevent XSS -1

Skrevet den 14. oktober 201920. november 2024 af i WooCommerce

The coupon code and note were not properly escaped and sanitized against an XSS attack.

This vulnerability affects the following application versions:

Adding escaping to saving shipping zones to avoid XSS

Skrevet den 10. oktober 201920. november 2024 af i WooCommerce

Shipping zones settings were not properly sanitized against XSS.

This vulnerability affects the following application versions:

Escaping added to meta boxes product images to prevent XSS

Skrevet den 10. oktober 201920. november 2024 af i WooCommerce

Meta boxes product images were not properly sanitized against XSS.

This vulnerability affects the following application versions:

Escaping admin page add-ons to prevent XSS

Skrevet den 10. oktober 201920. november 2024 af i WooCommerce

Admin page add-ons were not properly escaped against XSS.

This vulnerability affects the following application versions:

Added escaping to admin helper to avoid XSS

Skrevet den 10. oktober 201920. november 2024 af i WooCommerce

Admin helper current filter was not properly sanitized against XSS.

This vulnerability affects the following application versions:

Added escaping to translatable Auth form grant access messages to prevent XSS

Skrevet den 1. oktober 201920. november 2024 af i WooCommerce

Auth form grant access were not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping added for admin meta boxes to prevent XSS

Skrevet den 1. oktober 201920. november 2024 af i WooCommerce

Admin meta boxes were not properly sanitized against XSS

This vulnerability affects the following application versions:

Escaping added for menu in view to prevent XSS

Skrevet den 30. september 201920. november 2024 af i WooCommerce

Menu tab was not properly sanitized against XSS.

This vulnerability affects the following application versions:

Added escaping in reporting and product lists to prevent XSS

Skrevet den 3. september 201920. november 2024 af i WooCommerce

Reports and product list tables were not properly escaped and sanitized against XSS.

This vulnerability affects the following application versions:

Filtering and validating of CSV files to prevent XSS

Skrevet den 3. september 201920. november 2024 af i WooCommerce

The tax rate and product importer of CSV files were not properly filtered and validated against XSS.

This vulnerability affects the following application versions:

Escaping and sanitising list table to prevent XSS

Skrevet den 3. september 201920. november 2024 af i WooCommerce

The list table for order and products were not properly escaped against XSS.

This vulnerability affects the following application versions:

Escaping metaboxes to prevent XSS

Skrevet den 3. september 201920. november 2024 af i WooCommerce

The metabox of the order data and the HTML keys were not properly escaped against XSS.

This vulnerability affects the following application versions:

Adding sanity checks for the API helper to prevent XSS

Skrevet den 7. august 201920. november 2024 af i WooCommerce

The API helper was not properly sanitized against XSS.

This vulnerability affects the following application versions:

Adding escaping to billing and price for single product to prevent XSS

Skrevet den 6. august 201920. november 2024 af i WooCommerce

The single product billing and price was not properly escaped against an XSS attack.

This vulnerability affects the following application versions:

Added escaping to PayPal gateway to prevent XSS

Skrevet den 6. august 201920. november 2024 af i WooCommerce

The PayPal gateway was not properly escaped against XSS.

This vulnerability affects the following application versions:

Adding escaping to structured data to prevent XSS

Skrevet den 24. juli 201920. november 2024 af i WooCommerce

The output of the structured data was not properly escaped against an XSS attack.

This vulnerability affects the following application versions:

Add JSON escaping to variation attribute to prevent XSS

Skrevet den 23. juli 201920. november 2024 af i WooCommerce

Variation attribute were not properly escaped against possible XSS attack vectors.

This vulnerability affects the following application versions:

Add JSON sanity checks to admin translation country option to prevent XSS

Skrevet den 23. juli 201920. november 2024 af i WooCommerce

The admin translation country option was not properly sanitized against possible XSS attack vectors.

This vulnerability affects the following application versions:

Sanitizing sales, coupon and customer report to prevent XSS

Skrevet den 23. juli 201918. oktober 2025 af i WooCommerce

Sales, coupon and customer report were not properly sanitized against XSS.

This vulnerability affects the following application versions:

Added escaping and sanitized to coupon code and note to prevent XSS

Skrevet den 11. juli 201920. november 2024 af i WooCommerce

The coupon code and note were not properly escaped and sanitized against an XSS attack.

This vulnerability affects the following application versions:

Added escaping to shipping notice to prevent XSS

Skrevet den 9. juli 201920. november 2024 af i WooCommerce

The shipping notice was not properly escaped against XSS attack vectors.

This vulnerability affects the following application versions:

Make sure that API messages are safe to print

Skrevet den 9. juli 201918. oktober 2025 af i WooCommerce

Messages for API were not properly encoded and sanitized before printed.

This vulnerability affects the following application versions:

Escaping json in product data variations to prevent XSS

Skrevet den 4. juli 201920. november 2024 af i WooCommerce

Data in product data variation was not properly sanitized against an XSS attack.

This vulnerability affects the following application versions:

Adding escaping to image gallery to avoid XSS

Skrevet den 5. juni 201920. november 2024 af i WooCommerce

Image gallery function was not escaped against an XSS attack.

This vulnerability affects the following application versions:

WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1
WooCommerce 3.4.2
WooCommerce 3.4.3
WooCommerce 3.4.4
WooCommerce 3.4.5
WooCommerce 3.4.6
WooCommerce 3.4.7
WooCommerce 3.4.8
WooCommerce 3.5.0
WooCommerce 3.5.0-rc.1
WooCommerce 3.5.0-rc.2
WooCommerce 3.5.1
WooCommerce 3.5.2
WooCommerce 3.5.3
WooCommerce 3.5.4

Adding escape to customer error display to avoid XSS

Skrevet den 4. juni 201920. november 2024 af i WooCommerce

Customer error display was not properly sanitized this could result in an XSS attack.

This vulnerability affects the following application versions:

At the admin notices page the GET variable was vulnerable to XSS

Skrevet den 29. april 201920. november 2024 af i WooCommerce

Official description: GitHub: Fixed PHPCS violations

This vulnerability affects the following application versions:

Escaping fix for admin metaboxes viewing translation to prevent XSS – 2

Skrevet den 17. april 201920. november 2024 af i WooCommerce

Data escaped and validated.

Official description: Admin metaboxes views translation escaping fix.

This vulnerability affects the following application versions:

Sanitize shipping method labels/titles – 3

Skrevet den 15. april 201918. oktober 2025 af i WooCommerce

wc_clean Sanitizes arrays recursively. And escaping for translated strings were added.

This vulnerability affects the following application versions:

Timing attack safe string comparison

Skrevet den 1. marts 201918. oktober 2025 af i WooCommerce

Timing attack could happen while comparing two strings.

This vulnerability affects the following application versions:

Escaping of html tags in the email address to prevent XSS

Skrevet den 22. februar 201920. november 2024 af i WooCommerce

Email Address was not properly escaped.

This vulnerability affects the following application versions:

Added escaping to the API to prevent XSS

Skrevet den 13. februar 201920. november 2024 af i WooCommerce

Stored XSS vulnerability through the API which could be exploited by users with write-access API keys.

This vulnerability affects the following application versions:

Sanitisation in product import/export

Skrevet den 13. februar 201918. oktober 2025 af i WooCommerce

The import and export were not properly sanitized.

This vulnerability affects the following application versions:

Escaping API keys in the edit view to prevent XSS

Skrevet den 12. februar 201920. november 2024 af i WooCommerce

Unescaped view of the API settings key could result in an XSS attack.

This vulnerability affects the following application versions:

Sanitation of post content in the API products to prevent XSS

Skrevet den 16. januar 201918. oktober 2025 af i WooCommerce

Post content of the API products were not well sanitised and could result in an XSS attack.

This vulnerability affects the following application versions:

Check for permissions before allow edit REST API keys

Skrevet den 3. januar 201920. november 2024 af i WooCommerce

Check for user role permissions before allow to edit or remove the REST API keys.

This vulnerability affects the following application versions:

Added escaping for select query and unserialize data only if it was serialized when using taxanomy

Skrevet den 10. december 201812. juni 2025 af i WooCommerce

When updating product attributes the old taxonomy slug was not properly escaped. And it’s now only unserializing data if data was serialized.

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1
WooCommerce 3.4.2
WooCommerce 3.4.3
WooCommerce 3.4.4
WooCommerce 3.4.5

No proper escape at oauth start to avoid XSS

Skrevet den 6. december 201818. oktober 2025 af i WooCommerce

Text at Oauth start had not been properly escaped.

This vulnerability affects the following application versions:

The shopmanager can only change the customer data

Skrevet den 6. december 201818. oktober 2025 af i WooCommerce

The user rights for the shop manager is changed, it allows the shop manager to change only the customer details in the user management page.

This vulnerability affects the following application versions:

Extra file type checking added

Skrevet den 20. november 201820. november 2024 af i WooCommerce

CSV Import function at administrator page extended with extra file type checking.

This vulnerability affects the following application versions:

Added exception for when a non-admin user tries to assign API keys to an admin

Skrevet den 20. november 201820. november 2024 af i WooCommerce

There’s now a check to see if the current user has the permission to assign an API key.

This vulnerability affects the following application versions:

Specific webhooks are not allowed anymore

Skrevet den 20. november 201818. oktober 2025 af i WooCommerce

Topics such as login credentials and the path to the product CSV import file are blacklisted as callbacks.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1
WooCommerce 3.4.2
WooCommerce 3.4.3
WooCommerce 3.4.4
WooCommerce 3.4.5
WooCommerce 3.4.6
WooCommerce 3.4.7
WooCommerce 3.4.8
WooCommerce 3.5.0
WooCommerce 3.5.0-beta.1
WooCommerce 3.5.0-rc.1
WooCommerce 3.5.0-rc.2

Allow shop managers to only manipulate customers through REST API

Skrevet den 8. november 201820. november 2024 af i WooCommerce

Via the Woocommerce API, it is permitted for the shopmanager to solely adjust the data of customers.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1
WooCommerce 3.4.2
WooCommerce 3.4.3
WooCommerce 3.4.4
WooCommerce 3.4.5
WooCommerce 3.4.6
WooCommerce 3.4.7
WooCommerce 3.4.8
WooCommerce 3.5.0
WooCommerce 3.5.0-beta.1
WooCommerce 3.5.0-rc.1
WooCommerce 3.5.0-rc.2

Sanitize file_url in the admin imports taxes page to prevent XSS

Skrevet den 7. november 201818. oktober 2025 af i WooCommerce

Official description: PHPCS fixes for includes/admin/importers directory.

This vulnerability affects the following application versions:

Sanitize error title admin section to prevent XSS

Skrevet den 6. november 201818. oktober 2025 af i WooCommerce

Sanitize error title admin section to prevent XSS

This vulnerability affects the following application versions:

Sanitize $handle in the admin log page to prevent XSS

Skrevet den 6. november 201818. oktober 2025 af i WooCommerce

Sanitize $handle in the admin log page to prevent XSS, and a check if the log file which is about to be deleted also really exists in the log directory.

This vulnerability affects the following application versions:

WooCommerce 3.4.4
WooCommerce 3.4.5
WooCommerce 3.5.0-beta.1
WooCommerce 3.5.0-rc.1

Several refund elements were vulnerable to XSS

Skrevet den 5. november 201818. oktober 2025 af i WooCommerce

Adding proper escaping for admin refund part to avoid XSS.

This vulnerability affects the following application versions:

Added missing escaping on product quick edit to avoid XSS

Skrevet den 1. november 201820. november 2024 af i WooCommerce

Better escaping on product quick edit.

This vulnerability affects the following application versions:

Added sanitation to attribut taxonomy to avoid XSS

Skrevet den 1. november 201820. november 2024 af i WooCommerce

Improvements to wc_create_attributes (DRI).

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1
WooCommerce 3.4.2
WooCommerce 3.4.3
WooCommerce 3.4.4

Additional escaping in the includes/shortcode to prevent XSS

Skrevet den 31. oktober 201820. november 2024 af i WooCommerce

Official description: Fixed includes/shortcode PHPCS violations.

This vulnerability affects the following application versions:

Billing and shipping address titles were not properly escaped for XSS

Skrevet den 31. oktober 201820. november 2024 af i WooCommerce

Both titles are now properly escaped and protected against XSS.

This vulnerability affects the following application versions:

Sanitize variables in the wc-auth file to prevent XSS

Skrevet den 30. oktober 201818. oktober 2025 af i WooCommerce

Official description: Fixed includes/class-wc-auth.php PHPCS violations.

This vulnerability affects the following application versions:

Redirect not properly escaped when revoking REST API keys

Skrevet den 30. oktober 201818. oktober 2025 af i WooCommerce

Redirect url was not safely escaped.

This vulnerability affects the following application versions:

MIME type validation when uploading file via REST API’s

Skrevet den 30. oktober 201818. oktober 2025 af i WooCommerce

Official description: Only allow image MIME type upload via REST APIs.

This vulnerability affects the following application versions:

WooCommerce 2.5.0
WooCommerce 2.5.0-RC1
WooCommerce 2.5.0-RC2
WooCommerce 2.5.0-RC3
WooCommerce 2.5.1
WooCommerce 2.5.2
WooCommerce 2.5.3
WooCommerce 2.5.4
WooCommerce 2.5.5
WooCommerce 2.6.0
WooCommerce 2.6.0-RC2
WooCommerce 2.6.1
WooCommerce 2.6.2
WooCommerce 2.6.3

Catalog ordering “orderby” var was vulnerable to XSS

Skrevet den 30. oktober 201820. november 2024 af i WooCommerce

Official description: Check query var for orderby.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4

Add new function to sanitize cost in shipping to prevent XSS

Skrevet den 17. oktober 201820. november 2024 af i WooCommerce

Official description: Flat rate: remove currency symbols.

This vulnerability affects the following application versions:

Sanitize product id list in “product-function” to prevent XSS

Skrevet den 15. oktober 201818. oktober 2025 af i WooCommerce

Official description: GitHub: phpcs

This vulnerability affects the following application versions:

Sanitize variables in templates/cart to prevent XSS

Skrevet den 15. oktober 201818. oktober 2025 af i WooCommerce

Officiële description: Add names to nonces in template files.

This vulnerability affects the following application versions:

Path field in advanced CSV importer was broken due to an esc_url call

Skrevet den 15. oktober 201818. oktober 2025 af i WooCommerce

This fix removes the incorrect esc_url() call and replaces it with wc_clean() instead.

This vulnerability affects the following application versions:

WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2

Additional escaping for checkout templates

Skrevet den 11. oktober 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for template form-pay.php

This vulnerability affects the following application versions:

Additional escaping for admin setting views

Skrevet den 9. oktober 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for html-admin-page-shipping-classes.php.

This vulnerability affects the following application versions:

Additional escaping for general metabox functions

Skrevet den 8. oktober 201820. november 2024 af i WooCommerce

Official description: When custom attributes are created, they are decoded. Make the values match correctly.

This vulnerability affects the following application versions:

Additional escaping of admin importing components

Skrevet den 8. oktober 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for html-csv-import-mapping.php.

This vulnerability affects the following application versions:

Correctly sanitize posted attributes when JS is off

Skrevet den 1. oktober 201820. november 2024 af i WooCommerce

Sanitizes posted attributes when JS is off.

This vulnerability affects the following application versions:

Additional escaping for myaccount templates

Skrevet den 27. september 201820. november 2024 af i WooCommerce

Official description: Auth screen escaping.

This vulnerability affects the following application versions:

Correct sanitization of admin components

Skrevet den 20. september 201820. november 2024 af i WooCommerce

Official description: Fixed coding standards for WC_Admin_Settings.

This vulnerability affects the following application versions:

Additional escaping for order templates

Skrevet den 18. september 201820. november 2024 af i WooCommerce

Official description: Additional escaping for order templates.

This vulnerability affects the following application versions:

Confirm navigation if nonce has expired in reports

Skrevet den 18. september 201820. november 2024 af i WooCommerce

In reports, improved XSS filtering and confirm navigation if nonce has expired.

This vulnerability affects the following application versions:

Additional sanitization of API components

Skrevet den 23. august 201820. november 2024 af i WooCommerce

Official description: Properly sanitize and format “dp”.

This vulnerability affects the following application versions:

Additional escaping for email templates

Skrevet den 23. august 201820. november 2024 af i WooCommerce

Official description: Correct errors per PHPCS.

This vulnerability affects the following application versions:

Additional escaping for admin views to prevent XSS

Skrevet den 6. august 201820. november 2024 af i WooCommerce

Official description: Fix escaping.

This vulnerability affects the following application versions:

Additional escaping of admin reports in order to prevent XSS

Skrevet den 6. august 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for class-wc-report-sales-by-category.php.

This vulnerability affects the following application versions:

Add escaping to email downloads to prevent XSS

Skrevet den 1. august 201820. november 2024 af i WooCommerce

Official description: Switch to variable.

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6

Escaping attribute label in single product page to prevent XSS

Skrevet den 1. august 201820. november 2024 af i WooCommerce

Official description: Update action placement so all product types are consistent.

This vulnerability affects the following application versions:

Proper escaping of login form

Skrevet den 31. juli 201818. oktober 2025 af i WooCommerce

Official description: PHPCS fixes for global/form-login.php.

This vulnerability affects the following application versions:

Unsanitized woocommerce_attribute_label

Skrevet den 31. juli 201818. oktober 2025 af i WooCommerce

Official description: Add filter to sanitize woocommerce_attribute_label.

This vulnerability affects the following application versions:

Escaping fix for admin metaboxes viewing translation

Skrevet den 30. juli 201820. november 2024 af i WooCommerce

Data escaped and validated. Plus translator comment documentation added.

Official description: Admin metaboxes views translation escaping fix.

This vulnerability affects the following application versions:

Escaping translations in admin status reports page to prevent XSS

Skrevet den 30. juli 201820. november 2024 af i WooCommerce

Official description: Manually fix coding standard violations that can’t be fixed with phpcbf.

This vulnerability affects the following application versions:

Additional escaping in the includes/gateways folder to prevent XSS

Skrevet den 26. juli 201820. november 2024 af i WooCommerce

Official description: GitHub: PHPCS fixes for includes/gateways directory #19341

This vulnerability affects the following application versions:

Placeholder was vulnerable for XSS

Skrevet den 25. juli 201818. oktober 2025 af i WooCommerce

Official description: Use correct escaping on placeholder.

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6
WooCommerce 3.4.0
WooCommerce 3.4.0-beta.1
WooCommerce 3.4.0-rc.1
WooCommerce 3.4.0-rc.2
WooCommerce 3.4.1

Escape translation in a customer download log data page to prevent XSS

Skrevet den 24. juli 201820. november 2024 af i WooCommerce

Official description: GDPR – Personal data export and removal.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6

Sanitize gateway_order in the payment gateway class to prevent XSS

Skrevet den 24. juli 201818. oktober 2025 af i WooCommerce

Official description: Fixed payment main classes PHPCS violations.

This vulnerability affects the following application versions:

Escaping variables in the e-mail class to prevent XSS

Skrevet den 24. juli 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for includes/emails directory.

This vulnerability affects the following application versions:

Clean search label with queries

Skrevet den 23. juli 201820. november 2024 af i WooCommerce

Official Description: Add search label when searching via product crud helper.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1

Escaping translations in admin shipping settings page to prevent XSS

Skrevet den 23. juli 201820. november 2024 af i WooCommerce

Official description: Set more defaults to reduce query count.

This vulnerability affects the following application versions:

Corrects html filter for wc-action-button from esc_attr to esc_html

Skrevet den 19. juli 201820. november 2024 af i WooCommerce

Official description: Allow modal to be wider and fix button wrapping.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2-rc.1

sanitize_text_field Didn’t preserve line breaks wp_kses_post

Skrevet den 19. juli 201818. oktober 2025 af i WooCommerce

Official description: sanitize_text_field does not preserve line breaks. wp_kses_post.

This vulnerability affects the following application versions:

Additional escaping in the admin quick edit product view to prevent XSS

Skrevet den 18. juli 201820. november 2024 af i WooCommerce

Official description: Product backorder stock status.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6

Escaping translations in the plugin-update view to prevent XSS

Skrevet den 18. juli 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for includes/admin/plugin-updates directory

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2
WooCommerce 3.3.1
WooCommerce 3.3.1-rc.1
WooCommerce 3.3.2
WooCommerce 3.3.2-rc.1
WooCommerce 3.3.3
WooCommerce 3.3.4
WooCommerce 3.3.5
WooCommerce 3.3.6

Escaping variables in admin customer report page to prevent XSS

Skrevet den 18. juli 201820. november 2024 af i WooCommerce

Official description: Fix PHPCS violations in includes/admin/reports/class-wc-report-customers.php.

This vulnerability affects the following application versions:

Sanitize product_type in the post data file to prevent XSS

Skrevet den 18. juli 201818. oktober 2025 af i WooCommerce

Official description: Fixed post classes PHPCS violations.

This vulnerability affects the following application versions:

Escaping translations in api keys pages and check referer source to prevent XSS

Skrevet den 16. juli 201820. november 2024 af i WooCommerce

Official description: Check admin referer instead of nonce, just like webhooks.

This vulnerability affects the following application versions:

Widget settings labels were vulnerable to XSS

Skrevet den 16. juli 201818. oktober 2025 af i WooCommerce

Official description: PHPCS passing for abstract-wc-widget.php.

This vulnerability affects the following application versions:

Escaping keys-edit admin page to prevent XSS

Skrevet den 16. juli 201820. november 2024 af i WooCommerce

Official description: tip alignment

This vulnerability affects the following application versions:

Escape “Reduce stock” and “Increase stock” note in admin order page to prevent XSS

Skrevet den 16. juli 201820. november 2024 af i WooCommerce

Official description: Allow for multiple stock updates at once.

This vulnerability affects the following application versions:

Escaping translation in the comment validation to prevent XSS

Skrevet den 16. juli 201820. november 2024 af i WooCommerce

Official description: Fixed includes/class-wc-comments.php PHPCS violations.

This vulnerability affects the following application versions:

Escaping Fix for admin metaboxes viewing translation

Skrevet den 12. juli 201820. november 2024 af i WooCommerce

Data escaped and validated. Plus translator comment documentation added.

Official description: Admin metaboxes views translation escaping fix.

This vulnerability affects the following application versions:

Additional escaping for cart templates preventing XSS

Skrevet den 12. juli 201820. november 2024 af i WooCommerce

Official description: PHPCS fixes for cart.php template

This vulnerability affects the following application versions:

Sanitizes widget output to prevent XSS flaws

Skrevet den 12. juli 201818. oktober 2025 af i WooCommerce

Sanitization of widget components.

This vulnerability affects the following application versions:

Additional escaping for product templates preventing XSS

Skrevet den 12. juli 201820. november 2024 af i WooCommerce

Official description: Grouped products; allow custom columns and changes to values.

This vulnerability affects the following application versions:

Additional escaping/sanitization for includes/classes

Skrevet den 4. juni 201820. november 2024 af i WooCommerce

Official Description: Tweak where meta gets sanitized before passing to comparison function.

Escaping for includes/classes. WooCommerce 3.3.0 Introduces fixes for XSS flaws, including those covered in this patch.

This vulnerability affects the following application versions:

Additional sanitization of common functions

Skrevet den 8. maj 201820. november 2024 af i WooCommerce

Sanitization of various functions in order to prevent XSS.

Official description: Remove kses from before/after attribute.

This vulnerability affects the following application versions:

Escape transactional email error message

Skrevet den 15. februar 201820. november 2024 af i WooCommerce

Prior to version 3.3.1 of WooCommerce, the callback referenced in the fatal error message for transaction emails was not properly escaped, potentially leading to XSS.

This vulnerability affects the following application versions:

WooCommerce 3.0.2
WooCommerce 3.0.3
WooCommerce 3.0.4
WooCommerce 3.0.5
WooCommerce 3.0.6
WooCommerce 3.0.7
WooCommerce 3.0.8
WooCommerce 3.0.9
WooCommerce 3.1.0
WooCommerce 3.1.0-rc.1
WooCommerce 3.1.0-rc.2
WooCommerce 3.1.1
WooCommerce 3.1.2
WooCommerce 3.2.0
WooCommerce 3.2.0-rc.1
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4
WooCommerce 3.2.5
WooCommerce 3.2.6
WooCommerce 3.3.0
WooCommerce 3.3.0-rc.1
WooCommerce 3.3.0-rc.2

Typecast product page to int

Skrevet den 15. februar 201818. oktober 2025 af i WooCommerce

In WooCommerce versions earlier than 3.3.1, it was possible to input negative or non-integer values as the product page in the query string.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.2

Image sizes vulnerable to command injection typecast sizes to int

Skrevet den 15. februar 201820. november 2024 af i WooCommerce

In WooCommerce version prior to 3.3.1, there were no constraints to prevent negative or non-integer image sizes from being processed as-is, which could result in unpredictable behavior, buffer overflows, or even command injection. This fix uses absint to ensure that all image sizes are positive integers.

This vulnerability affects the following application versions:

WooCommerce 3.3.0
WooCommerce 3.3.0-rc.2

Saving variation attributes on new products and with attributes containing slashes could lead to XSS

Skrevet den 14. februar 201818. oktober 2025 af i WooCommerce

Products with title variations did not have the titles sanitized when populated with default values, which could potentially result in a stored XSS vulnerability. Although the fix was ostensibly to help compatibility with newer versions of WordPress, it also addresses a potential security flaw. Fixed in WooCommerce 3.2.5

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1
WooCommerce 3.2.2
WooCommerce 3.2.3
WooCommerce 3.2.4

Cached Queries in Shortcodes Lead to Object Injection

Skrevet den 14. februar 201820. november 2024 af i WooCommerce

Versions 3.2.3 and earlier are affected by an issue where cached queries within shortcodes could lead to object injection. This is related to the recent WordPress 4.8.3 security release. This issue can only be exploited by users who can edit content and add shortcodes.

This vulnerability affects the following application versions:

Escape URLs added for product downloads in CSV importer avoiding code injection

Skrevet den 14. februar 201820. november 2024 af i WooCommerce

Versions 3.2.1 and earlier are affected by an issue where shortcodes and relative URLs for product downloads are not handled or escaped correctly by the CSV importer, which could potentially result in code injection.

This vulnerability affects the following application versions:

WooCommerce 3.1.0
WooCommerce 3.1.1
WooCommerce 3.1.2
WooCommerce 3.2.0
WooCommerce 3.2.0-rc.2
WooCommerce 3.2.1

Nonce keys, post descriptions, and other items were vulnerable to XSS

Skrevet den 14. februar 201818. oktober 2025 af i WooCommerce

Version 3.2.1 and earlier did not properly sanitize nonce keys, post descriptions, and other items, potentially leading to XSS vulnerabilities.

This vulnerability affects the following application versions:

Escape HTML for Post Validation Error Messages

Skrevet den 14. februar 201820. november 2024 af i WooCommerce

Adds escape html filters to the error messages coming from post validation.

This vulnerability affects the following application versions:

WooCommerce 3.0.0
WooCommerce 3.0.1
WooCommerce 3.0.2
WooCommerce 3.0.3
WooCommerce 3.0.4
WooCommerce 3.0.5
WooCommerce 3.0.6
WooCommerce 3.0.7
WooCommerce 3.0.8
WooCommerce 3.0.9
WooCommerce 3.1.0
WooCommerce 3.1.0-rc.1
WooCommerce 3.1.0-rc.2
WooCommerce 3.1.1
WooCommerce 3.1.2

Sanitize Keys in Reports Class

Skrevet den 14. februar 201818. oktober 2025 af i WooCommerce

Sanitizes the names (keys) of the field data while displaying the admin reports.

This vulnerability affects the following application versions:

Escapes URL Raw for an admin URL

Skrevet den 14. februar 201820. november 2024 af i WooCommerce

Admin URL is escaped using escape URL raw.

This vulnerability affects the following application versions:

WooCommerce 3.2.0
WooCommerce 3.2.1

Sanitizes hash check to avoid XSS

Skrevet den 14. februar 201818. oktober 2025 af i WooCommerce

WooCommerce version prior to 3.2.4 failed to unslash geolocation hashes and redirect URLs, and failed to properly escape an admin URL

This vulnerability affects the following application versions:

Om os

Standoutmedia er et webbureau dedikeret til WordPress platformen.
Vi driver egne hostingløsninger, hvor tusindvis af kunder hver dag modtager sikkerhedsopdateringer.

Læs mere om os her: https://standoutmedia.dk/