Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-9944: WooCommerce allows unauthenticated HTML injection in order forms
CVE-2024-9944 · published 2 years ago
Summary
The WooCommerce plugin for WordPress lets anyone add custom HTML to order form submissions, which is then displayed when an admin views the order. This could let attackers insert unwanted content or scripts into the admin view. Update WooCommerce to a version newer than 9.0.2 or apply the vendor’s patch to stop the issue.
What to do
- Update woocommerce woocommerce to version 9.1.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| woocommerce | woocommerce |
< 9.1.0 cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:free:wordpress:*:* |
Original advisory text
WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new... URL
- https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/changelog.txt URL
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a63... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9944.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-9944 Vendor Advisory
- https://github.com/woocommerce/woocommerce/pull/49370 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta