UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-37297

WooCommerce: Cross-site Scripting

Severity
Medium 5.4
Published
10 Jun 2024
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
8.8.5, 8.9.3
Also known as
WPV-7eae8f2742e8
Sources
NVD, WPVulnerability

Description

WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in…

Affected software

SoftwareAffected versions
WooCommerceServers and applications · cpe:a:woocommerce:woocommerce
  • From 8.8 before 8.8.5
  • From 8.9.0 before 8.9.3
WooCommerceWordPress plugins · wp-plugin:woocommerce
  • Every version before 8.9.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-37297
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-37297
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce/woocommerce-880-892-reflected-cross-site-scripting-via-order-attribution