Description

Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:24.033Z",
  "pubdate": "2026-09-03T17:17:24.033Z",
  "executiveSummary": "The Product Variations Swatches for WooCommerce plugin, specifically versions 1.1.18 and below, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper sanitization and output escaping of user-supplied data during the processing of product variation attributes.\nA remote, authenticated attacker with Subscriber-level privileges can inject malicious JavaScript payloads into the variation settings.\nWhen a victim, such as an administrator or store manager, views the affected product pages or the administrative dashboard, the injected script executes within the context of the user's browser session.\nThe potential impact includes unauthorized actions, session hijacking, credential theft, and the modification of site content or configuration.\nThe vulnerability highlights a failure to enforce strict input validation for users with low-level administrative or store-related access, allowing for the persistence of malicious code that affects higher-privileged accounts.\nGiven the nature of WooCommerce environments, this flaw poses a critical risk to site integrity and administrative security.",
  "technicalDetails": "The vulnerability exists within the Product Variations Swatches for WooCommerce plugin, specifically affecting versions 1.1.18 and earlier. The root cause is the failure of the application to properly sanitize and validate input fields related to product variation swatches before saving them to the WordPress database. Furthermore, the application fails to perform adequate output escaping when rendering this data in the front-end or administrative interface.\nThe attack vector requires the attacker to hold an account with at least Subscriber-level privileges, assuming the site configuration permits subscribers to interact with product-related inputs or via exploitation of secondary flaws that allow for unauthorized metadata updates. In many WooCommerce installations, variation settings are handled via AJAX-based endpoints that perform insufficient capability checks or data validation.\nThe exploitation flow proceeds as follows: First, the attacker identifies a request endpoint responsible for updating product variation metadata. Second, the attacker injects a crafted payload containing malicious JavaScript (e.g., <script>alert('XSS')</script> or more sophisticated document.cookie exfiltration strings) into a field that the plugin processes as a swatch attribute. Third, the plugin saves this payload into the database without sanitization, assuming it is benign text.\nWhen an administrative user or store manager navigates to the WooCommerce product edit screen or the product page itself, the plugin retrieves the malicious payload from the database and echoes it directly into the HTML document. Because the browser interprets this injected string as executable code, the script runs in the context of the victim's session.\nThe impact of this XSS is significant because it can lead to full administrative account takeover. An attacker can craft a payload that performs background requests to create new administrative accounts, alter payment gateway settings, or exfiltrate sensitive customer data by scraping the Document Object Model (DOM). Since the code executes on the victim's browser, it bypasses network-level security controls, as the malicious actions appear as legitimate requests originating from the authorized administrator's browser session. The vulnerability persists until the malicious variation data is manually cleared from the database or the vulnerable code path is patched to enforce attribute sanitization using WordPress's internal APIs like sanitize_text_field() or esc_html()."
}