Description

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:34.187Z",
  "pubdate": "2026-08-20T12:16:34.187Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Swatchly – WooCommerce Variation Swatches for Products plugin, specifically affecting versions 1.4.13 and below. This security flaw enables remote, unauthenticated threat actors to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the application and viewed by unsuspecting users. The primary impact of this vulnerability includes potential session hijacking, unauthorized actions performed on behalf of authenticated users, defacement of the affected e-commerce platform, and redirection to malicious external domains. Because the vulnerability requires no authentication or elevated privileges, the attack vector is accessible to any remote user interacting with the public-facing components of the web application over the network. Risk implications are severe for e-commerce platforms utilizing the affected plugin, as successful exploitation undermines the integrity of the client-side environment and compromises user trust. Exploitation requirements are minimal, primarily depending on the victim interacting with a crafted URL or component containing the malicious payload processed by the vulnerable plugin.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Swatchly – WooCommerce Variation Swatches for Products plugin for versions <= 1.4.13. The root cause stems from insufficient input sanitization and inadequate contextual output encoding of user-supplied parameters before they are reflected back into the Hypertext Transfer Protocol (HTTP) response. Consequently, the affected component processes malicious payloads containing arbitrary JavaScript without proper validation.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing a payload designed to break out of HTML attribute contexts or execute script tags. This payload is injected into parameters processed by the plugin during the rendering of product variation swatches. When a victim loads the compromised page, the web browser parses the response and executes the injected script within the security context of the victim's session. Due to the lack of authentication requirements and network exposure via the public-facing e-commerce storefront, any external user can trigger the execution flow.\nThe payload behavior involves executing arbitrary client-side code within the Document Object Model (DOM) of the victim's browser session. Post-exploitation impact includes the potential theft of sensitive session cookies, manipulation of page content to capture credentials, and the execution of unauthorized transactional commands if the victim possesses administrative or customer privileges. The vulnerability strictly affects Swatchly versions <= 1.4.13 and requires immediate remediation to prevent persistent or reflected script execution."
}