Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T10:17:11.843Z",
  "pubdate": "2026-09-04T10:17:11.843Z",
  "executiveSummary": "A DOM-based Cross-Site Scripting (XSS) vulnerability exists within the Xtemos WoodMart theme, specifically affecting versions prior to 8.3.8.\nThe vulnerability arises due to improper neutralization of user-supplied input during web page generation, allowing an attacker to inject and execute arbitrary JavaScript within the context of a victim's browser session.\nBy manipulating DOM elements through unsanitized input parameters, an attacker can hijack user sessions, perform unauthorized actions on behalf of the user, exfiltrate sensitive data, or inject malicious content into the affected page.\nThis vulnerability is classified as DOM-based XSS, as the malicious payload is processed and executed by the client-side scripts rather than the server-side response directly.\nSuccessful exploitation typically requires convincing a user to navigate to a specifically crafted URL containing the malicious payload.\nGiven the nature of XSS in a theme context, this represents a significant security risk to all users of the WoodMart theme, necessitating an immediate update to the patched version.",
  "technicalDetails": "The vulnerability is identified as an Improper Neutralization of Input During Web Page Generation, specifically resulting in a DOM-based Cross-Site Scripting (XSS) attack vector.\nDOM-based XSS occurs when an application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by writing that data to the DOM.\nIn the context of the Xtemos WoodMart theme, user-controlled input, likely sourced from URL parameters or fragment identifiers, is improperly handled by the theme's client-side scripting engine.\nThe root cause lies in the application's failure to adequately sanitize or validate data before passing it to dangerous JavaScript 'sinks'—functions or DOM elements that can execute code or render HTML.\nWhen a user visits a malicious URL crafted by an attacker, the payload is contained within a part of the URL (e.g., the query string or fragment) that the WoodMart JavaScript reads and then inadvertently injects into the Document Object Model.\nThe attack flow proceeds as follows: 1) The attacker constructs a URL containing a malicious JavaScript payload in the targeted parameter. 2) The attacker lures a victim, who may be an authenticated administrator or a regular user, into clicking the link. 3) The victim's browser navigates to the WoodMart-powered site, where the vulnerable client-side script executes. 4) The script extracts the payload from the URL and passes it to an unsafe sink (such as .innerHTML or similar methods). 5) The browser interprets the payload as legitimate code and executes it within the security context of the vulnerable origin.\nBecause the execution happens entirely within the victim's browser, the malicious script can access the DOM, cookies, local storage, and session tokens belonging to the WoodMart site.\nThis enables post-exploitation activities such as session hijacking (stealing session cookies), unauthorized modification of the page content, keylogging, or redirecting the user to malicious sites.\nThe vulnerability affects all WoodMart theme installations running versions prior to 8.3.8. There are no authentication requirements for an attacker to initiate this attack, as it is a client-side vulnerability triggered by the interaction with a crafted URL."
}