Description

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:23.670Z",
  "pubdate": "2026-08-06T15:17:23.670Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Facebook for WooCommerce plugin. This security flaw allows remote, unauthenticated attackers to inject malicious scripts into web pages rendered to site visitors and administrators.\nThe primary impact of this vulnerability includes potential session hijacking, unauthorized actions performed on behalf of authenticated users, defacement, and redirection to malicious external domains. The affected product is Facebook for WooCommerce version 3.7.5 and all prior versions.\nThe risk implications are critical for e-commerce platforms, as successful exploitation can compromise customer data, administrative sessions, and overall store integrity. Attackers require network access to the target website to deliver the payload, but do not require any prior authentication or special privileges.\nExploitation generally involves enticing a victim or administrator to interact with a crafted URL containing malicious script payloads that the vulnerable plugin fails to adequately sanitize or escape before outputting in the HTTP response.",
  "technicalDetails": "The vulnerability resides in the Facebook for WooCommerce plugin, specifically affecting versions 3.7.5 and below. The root cause stems from insufficient input sanitization and output encoding of user-supplied parameters handled by the plugin.\nBecause the flaw is unauthenticated, an attacker with network exposure to the WordPress installation can craft HTTP requests containing malicious JavaScript payloads without needing valid user credentials or administrative privileges.\nThe attack flow typically proceeds as follows: First, the attacker identifies a vulnerable endpoint or parameter within the Facebook for WooCommerce plugin that reflects user input directly into the Document Object Model (DOM) without proper sanitization. Second, the attacker constructs a malicious URL incorporating a specially crafted script payload (e.g., event handlers or inline JavaScript). Third, the attacker delivers this payload to a target user or administrator, often via phishing or social engineering. Fourth, when the victim accesses the crafted link, the web server processes the request and the vulnerable plugin echoes the unsanitized input back within the HTTP response. Finally, the victim's browser interprets the injected string as executable JavaScript within the context of the vulnerable origin, executing the payload.\nThe payload behavior can range from stealing session cookies and LocalStorage tokens to performing unauthorized administrative actions, such as creating new rogue administrator accounts or modifying site configurations. The post-exploitation impact includes full compromise of the affected WordPress site and potential exposure of sensitive customer transaction data."
}