CVE-2022-2099: WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2099?
CVE-2022-2099 is a vulnerability in the WooCommerce WordPress plugin before version 6.6.0 that allows stored HTML injection in payment gateway titles.
What is the severity of CVE-2022-2099?
CVE-2022-2099 has a severity level of medium with a CVSS score of 4.8.
How does CVE-2022-2099 impact WooCommerce WordPress plugin?
CVE-2022-2099 allows attackers to inject malicious HTML code into payment gateway titles, potentially leading to cross-site scripting (XSS) attacks.
Is there a fix for CVE-2022-2099 vulnerability?
Yes, the vulnerability can be fixed by updating the WooCommerce WordPress plugin to version 6.6.0 or newer.
Where can I find more information about CVE-2022-2099?
More information about CVE-2022-2099 can be found at the following reference: [CVE-2022-2099](https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7b).