Description
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
References
- https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do
- 20140917 Reflected XSS in WooCommerce - excelling e Commerce allows attackers ability to do almost anything an admin user can do (WordPress plugin) mailing-list
- https://wordpress.org/plugins/woocommerce/changelog
- 61377 third-party-advisory