CVE-2023-47777: WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability
First published: Thu Nov 30 2023(Updated: )
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a through 11.1.1.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Automattic Woocommerce | <=8.1.1 | |
| Automattic Woocommerce Blocks | <=11.1.1 |
Remedy
Update WooCommerce to 8.2.0 or a higher version.
Remedy
Update WooCommerce Blocks to 11.1.2 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve
- https://patchstack.com/database/vulnerability/woo-gutenberg-products-block/wordpress-woocommerce-blocks-plugin-11-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-1-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-47777.
What is the title of the vulnerability?
The title of the vulnerability is WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability.
What is the severity of CVE-2023-47777?
The severity of CVE-2023-47777 is medium.
Which software is affected by CVE-2023-47777?
The software affected by CVE-2023-47777 are Automattic WooCommerce (up to version 8.1.1) and Automattic WooCommerce Blocks (up to version 11.1.1).
How can the vulnerability CVE-2023-47777 be exploited?
CVE-2023-47777 can be exploited through stored Cross-Site Scripting (XSS) attacks.
- collector/nvd-api
- agent/title
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/severity
- agent/references
- agent/event
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/automattic
- canonical/automattic woocommerce
- version/automattic woocommerce/8.1.1
- canonical/automattic woocommerce blocks
- version/automattic woocommerce blocks/11.1.1