Lucene search

PatchstackCVELIST:CVE-2024-35777

HistoryJul 09, 2024 - 9:57 a.m.

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

2024-07-0909:57:21

CWE-74

Patchstack

www.cve.org

wordpress

woocommerce

content injection

vulnerability

automattic

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

EPSS

Percentile

9.2%

JSON

Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "woocommerce",
    "product": "WooCommerce",
    "vendor": "Automattic",
    "versions": [
      {
        "changes": [
          {
            "at": "9.0.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "8.9.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-9-2-content-injection-vulnerability?_s_id=cve