CVE-2025-49042: WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through 10.0.2.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49042?
CVE-2025-49042 is classified as a high-severity Stored Cross-site Scripting (XSS) vulnerability.
How do I fix CVE-2025-49042?
To fix CVE-2025-49042, you should update WooCommerce to version 10.0.3 or later.
Which versions of WooCommerce are affected by CVE-2025-49042?
CVE-2025-49042 affects WooCommerce versions up to and including 10.0.2.
What types of attacks can CVE-2025-49042 facilitate?
This vulnerability can facilitate Stored Cross-site Scripting (XSS) attacks, allowing attackers to inject malicious scripts.
Who is impacted by CVE-2025-49042?
Any user or administrator using affected versions of WooCommerce could be impacted by CVE-2025-49042.