WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection
The advisory, in context
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 6.6.0
Fixed in 6.6.0
287 explicitly affected versions
2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.7.0-RC1, 2.7.0-beta-1, 2.7.0-beta-2, 2.7.0-beta-3, 2.7.0-beta-4, 3.0.0, 3.0.0-rc.1, 3.0.0-rc.2, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-beta-1, 3.1.0-beta.2, 3.1.0-rc.1, 3.1.0-rc.2, 3.1.1, 3.1.2, 3.2.0, 3.2.0-beta.1, 3.2.0-beta.2, 3.2.0-rc.2, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.3.0, 3.3.0-beta.1, 3.3.0-beta.2, 3.3.0-rc.1, 3.3.0-rc.2, 3.3.1, 3.3.1-rc.1, 3.3.2, 3.3.2-rc.1, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.4.0, 3.4.0-beta.1, 3.4.0-beta.2, 3.4.0-rc.1, 3.4.0-rc.2, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.5.0, 3.5.0-beta.1, 3.5.0-rc.1, 3.5.0-rc.2, 3.5.1, 3.5.10, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.6.0, 3.6.0-beta1, 3.6.0-rc.1, 3.6.0-rc.2, 3.6.0-rc.3, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.7.0, 3.7.0-beta.1, 3.7.0-rc.1, 3.7.0-rc.2, 3.7.1, 3.7.2, 3.7.3, 3.8.0, 3.8.0-beta.1, 3.8.0-rc.1, 3.8.0-rc.2, 3.8.1, 3.8.2, 3.8.3, 3.9.0, 3.9.0-beta.1, 3.9.0-beta.2, 3.9.0-rc.1, 3.9.0-rc.2, 3.9.0-rc.3, 3.9.0-rc.4, 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 4.0.0, 4.0.0-beta.1, 4.0.0-rc.1, 4.0.0-rc.2, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.0-beta.1, 4.1.0-beta.2, 4.1.0-rc.1, 4.1.0-rc.2, 4.1.0-rc.3, 4.1.1, 4.1.2, 4.1.2.1, 4.1.3, 4.1.4, 4.2.0, 4.2.0-RC.1, 4.2.0-RC.2, 4.2.0-beta.1, 4.2.1, 4.2.2, 4.2.3, 4.2.3.1, 4.2.4, 4.2.5, 4.3.0, 4.3.0-beta.1, 4.3.0-rc.1, 4.3.0-rc.2, 4.3.0-rc.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.4.1, 4.3.5, 4.3.6, 4.4.0, 4.4.0-beta.1, 4.4.0-rc.1, 4.4.1, 4.4.2, 4.4.2.1, 4.4.3, 4.4.4, 4.5.0, 4.5.0-beta.1, 4.5.0-rc.1, 4.5.0-rc.2, 4.5.0-rc.3, 4.5.1, 4.5.2, 4.5.3, 4.5.3.1, 4.5.4, 4.5.5, 4.6.0, 4.6.0-beta.1, 4.6.0-rc.1, 4.6.1, 4.6.2, 4.6.3, 4.6.3.1, 4.6.4, 4.6.5, 4.7.0, 4.7.0-beta.1, 4.7.0-beta.2, 4.7.0-rc.1, 4.7.1, 4.7.1-beta.1, 4.7.2, 4.7.3, 4.7.4, 4.8.0, 4.8.0-beta.1, 4.8.0-rc.1, 4.8.0-rc.2, 4.8.1, 4.8.2, 4.8.3, 4.9.0, 4.9.0-beta.1, 4.9.0-rc.1, 4.9.0-rc.2, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 5.0.0, 5.0.0-beta.1, 5.0.0-beta.2, 5.0.0-rc.1, 5.0.0-rc.2, 5.0.0-rc.3, 5.0.1, 5.0.2, 5.0.3, 5.1.0, 5.1.0-beta.1, 5.1.0-rc.1, 5.1.1, 5.1.2, 5.1.3, 5.2.0, 5.2.0-beta.1, 5.2.0-rc.1, 5.2.0-rc.2, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.3.0, 5.3.0-beta.1, 5.3.0-rc.1, 5.3.0-rc.2, 5.3.1, 5.3.2, 5.3.3, 5.4.0, 5.4.0-beta.1, 5.4.0-rc.1, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.5.0, 5.5.0-beta.1, 5.5.0-rc.1, 5.5.0-rc.2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.6.0, 5.6.0-beta.1, 5.6.0-rc.1, 5.6.0-rc.2, 5.6.1, 5.6.2, 5.7.0, 5.7.0-beta.1, 5.7.0-rc.1, 5.7.0-rc.2, 5.7.1, 5.7.2, 5.8.0, 5.8.0-beta.1, 5.8.0-beta.2, 5.8.0-rc.1, 5.8.1, 5.9.0, 5.9.0-RC.1, 5.9.0-beta.1, 5.9.0-rc.2, 5.9.1, v3.2.0-RC1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.6.10",
"2.6.11",
"2.6.12",
"2.6.13",
"2.6.14",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.6.7",
"2.6.8",
"2.6.9",
"2.7.0-RC1",
"2.7.0-beta-1",
"2.7.0-beta-2",
"2.7.0-beta-3",
"2.7.0-beta-4",
"3.0.0",
"3.0.0-rc.1",
"3.0.0-rc.2",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.0-beta-1",
"3.1.0-beta.2",
"3.1.0-rc.1",
"3.1.0-rc.2",
"3.1.1",
"3.1.2",
"3.2.0",
"3.2.0-beta.1",
"3.2.0-beta.2",
"3.2.0-rc.2",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.3.0",
"3.3.0-beta.1",
"3.3.0-beta.2",
"3.3.0-rc.1",
"3.3.0-rc.2",
"3.3.1",
"3.3.1-rc.1",
"3.3.2",
"3.3.2-rc.1",
"3.3.3",
"3.3.4",
"3.3.5",
"3.3.6",
"3.4.0",
"3.4.0-beta.1",
"3.4.0-beta.2",
"3.4.0-rc.1",
"3.4.0-rc.2",
"3.4.1",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.5.0",
"3.5.0-beta.1",
"3.5.0-rc.1",
"3.5.0-rc.2",
"3.5.1",
"3.5.10",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.7",
"3.5.8",
"3.5.9",
"3.6.0",
"3.6.0-beta1",
"3.6.0-rc.1",
"3.6.0-rc.2",
"3.6.0-rc.3",
"3.6.1",
"3.6.2",
"3.6.3",
"3.6.4",
"3.6.5",
"3.6.6",
"3.6.7",
"3.7.0",
"3.7.0-beta.1",
"3.7.0-rc.1",
"3.7.0-rc.2",
"3.7.1",
"3.7.2",
"3.7.3",
"3.8.0",
"3.8.0-beta.1",
"3.8.0-rc.1",
"3.8.0-rc.2",
"3.8.1",
"3.8.2",
"3.8.3",
"3.9.0",
"3.9.0-beta.1",
"3.9.0-beta.2",
"3.9.0-rc.1",
"3.9.0-rc.2",
"3.9.0-rc.3",
"3.9.0-rc.4",
"3.9.1",
"3.9.2",
"3.9.3",
"3.9.4",
"3.9.5",
"4.0.0",
"4.0.0-beta.1",
"4.0.0-rc.1",
"4.0.0-rc.2",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.1.0",
"4.1.0-beta.1",
"4.1.0-beta.2",
"4.1.0-rc.1",
"4.1.0-rc.2",
"4.1.0-rc.3",
"4.1.1",
"4.1.2",
"4.1.2.1",
"4.1.3",
"4.1.4",
"4.2.0",
"4.2.0-RC.1",
"4.2.0-RC.2",
"4.2.0-beta.1",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.3.1",
"4.2.4",
"4.2.5",
"4.3.0",
"4.3.0-beta.1",
"4.3.0-rc.1",
"4.3.0-rc.2",
"4.3.0-rc.3",
"4.3.1",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.4.1",
"4.3.5",
"4.3.6",
"4.4.0",
"4.4.0-beta.1",
"4.4.0-rc.1",
"4.4.1",
"4.4.2",
"4.4.2.1",
"4.4.3",
"4.4.4",
"4.5.0",
"4.5.0-beta.1",
"4.5.0-rc.1",
"4.5.0-rc.2",
"4.5.0-rc.3",
"4.5.1",
"4.5.2",
"4.5.3",
"4.5.3.1",
"4.5.4",
"4.5.5",
"4.6.0",
"4.6.0-beta.1",
"4.6.0-rc.1",
"4.6.1",
"4.6.2",
"4.6.3",
"4.6.3.1",
"4.6.4",
"4.6.5",
"4.7.0",
"4.7.0-beta.1",
"4.7.0-beta.2",
"4.7.0-rc.1",
"4.7.1",
"4.7.1-beta.1",
"4.7.2",
"4.7.3",
"4.7.4",
"4.8.0",
"4.8.0-beta.1",
"4.8.0-rc.1",
"4.8.0-rc.2",
"4.8.1",
"4.8.2",
"4.8.3",
"4.9.0",
"4.9.0-beta.1",
"4.9.0-rc.1",
"4.9.0-rc.2",
"4.9.1",
"4.9.2",
"4.9.3",
"4.9.4",
"4.9.5",
"5.0.0",
"5.0.0-beta.1",
"5.0.0-beta.2",
"5.0.0-rc.1",
"5.0.0-rc.2",
"5.0.0-rc.3",
"5.0.1",
"5.0.2",
"5.0.3",
"5.1.0",
"5.1.0-beta.1",
"5.1.0-rc.1",
"5.1.1",
"5.1.2",
"5.1.3",
"5.2.0",
"5.2.0-beta.1",
"5.2.0-rc.1",
"5.2.0-rc.2",
"5.2.1",
"5.2.2",
"5.2.3",
"5.2.4",
"5.2.5",
"5.3.0",
"5.3.0-beta.1",
"5.3.0-rc.1",
"5.3.0-rc.2",
"5.3.1",
"5.3.2",
"5.3.3",
"5.4.0",
"5.4.0-beta.1",
"5.4.0-rc.1",
"5.4.1",
"5.4.2",
"5.4.3",
"5.4.4",
"5.5.0",
"5.5.0-beta.1",
"5.5.0-rc.1",
"5.5.0-rc.2",
"5.5.1",
"5.5.2",
"5.5.3",
"5.5.4",
"5.6.0",
"5.6.0-beta.1",
"5.6.0-rc.1",
"5.6.0-rc.2",
"5.6.1",
"5.6.2",
"5.7.0",
"5.7.0-beta.1",
"5.7.0-rc.1",
"5.7.0-rc.2",
"5.7.1",
"5.7.2",
"5.8.0",
"5.8.0-beta.1",
"5.8.0-beta.2",
"5.8.0-rc.1",
"5.8.1",
"5.9.0",
"5.9.0-RC.1",
"5.9.0-beta.1",
"5.9.0-rc.2",
"5.9.1",
"v3.2.0-RC1"
]
}