PT-2023-30602 · Automattic · Woocommerce Blocks+1

Rafie Muhammad · Published 2023-11-30 · Updated 2023-12-05 · CVE-2023-47777

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WooCommerce versions through 8.1.1 WooCommerce Blocks versions through 11.1.1

Description The issue affects Automattic WooCommerce and Automattic WooCommerce Blocks, allowing Stored XSS due to improper neutralization of input during web page generation. This is a Cross-site Scripting vulnerability.

Recommendations For WooCommerce versions through 8.1.1, update to a version later than 8.1.1 to resolve the issue. For WooCommerce Blocks versions through 11.1.1, update to a version later than 11.1.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the web application to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47777

Affected Products

Woocommerce

Woocommerce Blocks

References · 9

• 🔥 https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve · Exploit
• https://osv.dev/vulnerability/CVE-2023-47777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47777 · Security Note
• https://twitter.com/CVEnew/status/1730202468246757677 · Twitter Post
• https://t.me/cvenotify/61630 · Telegram Post
• https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-1-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1730218403061768401 · Twitter Post
• https://t.me/cvenotify/62361 · Telegram Post
• https://patchstack.com/database/vulnerability/woo-gutenberg-products-block/wordpress-woocommerce-blocks-plugin-11-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note