Description

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:24.187Z",
  "pubdate": "2026-08-06T15:17:24.187Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the WooCommerce Multilingual & Multicurrency plugin for WordPress, affecting all versions up to and including 5.5.6. This security flaw allows authenticated users with subscriber-level privileges to inject malicious scripts into the application, which are subsequently executed within the context of other users' browsers when viewing the compromised data.\nThe primary impact of this vulnerability is the potential compromise of user sessions, arbitrary JavaScript execution in the browser of unsuspecting administrators or users, and potential privilege escalation or unauthorized administrative actions if an administrator interacts with the malicious payload. The risk implications are moderate to high, depending on the privileges of the victim viewing the injected content.\nExploitation requires the attacker to hold an authenticated subscriber account on the target WordPress installation. No complex interaction beyond standard user access is required, as the vulnerability stems from insufficient input sanitization and output encoding within the affected component of the plugin.",
  "technicalDetails": "The vulnerability is a classic Cross-Site Scripting (XSS) flaw arising from improper handling of user-supplied input within WooCommerce Multilingual & Multicurrency versions 5.5.6 and prior. Specifically, the application fails to adequately sanitize or escape data before rendering it back to the user interface, allowing arbitrary HTML and JavaScript payloads to be stored and subsequently executed.\nAttack flow begins with an authenticated attacker possessing subscriber-level privileges. The attacker crafts a malicious HTTP request containing a payload consisting of executable JavaScript encapsulated within HTML tags or event handlers. This payload is submitted to vulnerable input parameters processed by the plugin.\nBecause the application lacks robust input validation and output encoding mechanisms, the malicious payload is accepted and persisted within the database or reflected improperly in subsequent HTTP responses. When a victim—such as an administrator or another high-privilege user—navigates to the affected administrative or frontend interface where the payload is rendered, the browser parses the injected script as legitimate code.\nThe payload executes under the Document Object Model (DOM) of the victim's session, granting the attacker the ability to perform actions on behalf of the victim, intercept session cookies, manipulate page content, or pivot further into the WordPress environment. The vulnerability requires network access to the target WordPress site and a valid subscriber-level authentication token to initiate the injection phase."
}