CVE-2019-18834 - Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php

Back Back to CVE browser

MEDIUM

Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php

Published Jul 23, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 1.63%

Description

Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8536
Advisory
https://woocommerce.com/products/woocommerce-subscriptions/
x_refsource_MISCProductVendor Advisory
https://www.precursorsecurity.com/blog
x_refsource_MISCThird Party Advisory
https://www.precursorsecurity.com/blog/woocommerce-subscriptions-persistent-xss-cve-2019-18834
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8536		Advisory
https://woocommerce.com/products/woocommerce-subscriptions/		x_refsource_MISCProductVendor Advisory
https://www.precursorsecurity.com/blog		x_refsource_MISCThird Party Advisory
https://www.precursorsecurity.com/blog/woocommerce-subscriptions-persistent-xss-cve-2019-18834		x_refsource_MISCExploitThird Party Advisory