Medium severity · published Jul 17, 2022
CVE-2022-2099
WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WooCommerce ·
before 6.6.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2099
Exploit
https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7b
More from WooCommerce
4.9
CVE-2024-1310
WooCommerce < 8.6 - Contributor+ Private/Draft Products Access
4.3
CVE-2022-0775
WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion