Volerion logoVolerion
Volerion logoVolerion

WooCommerce PostMessage-Based Cross-Site Scripting Vulnerability

Vulnerability

A cross-site scripting vulnerability has been identified in the WooCommerce plugin for WordPress, affecting all versions through 9.4.2. The issue arises on the 'customize-store' page, where inadequate input sanitization and output escaping of PostMessage data allow unauthenticated attackers to inject arbitrary scripts. These scripts could execute if a user is tricked into interacting with a link.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts can be executed in the context of the user's browser.

Remediation

Users can update to WooCommerce versions 9.3.4 or 9.4.3 to address this vulnerability.

Added: Jun 5, 2025, 11:32 PM
Updated: Jun 6, 2025, 12:06 AM

Vulnerability Rating

Custom Algorithm
spread
7.6
impact
1.7
exploitability
7.2
remediation
7.7
relevance
0.0
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.