CVE-2022-2099

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles

Affected

WooCommerce

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.67% chance of exploitation in the next 30 days, 51st percentile

Published

2022-07-17

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7b

Security advisories

• advisories/GHSA-jwvf-28fg-g4xg

References

• CVE Record
• NVD entry