CVE-2024-37297

Packagist/woocommerce/woocommerce CVE-2024-37297: medium 5.4, EPSS 0.48%

WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms

Action: Upgrade woocommerce/woocommerce to 8.8.5 or later.

composer require woocommerce/woocommerce:8.8.5

composer require woocommerce/woocommerce:8.9.3

Affected

Fixed versions

Sources

• osv: GHSA-cv23-q6gh-xfrf
• https://github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf
• https://nvd.nist.gov/vuln/detail/CVE-2024-37297
• https://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4
• https://github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67
• https://developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0
• https://github.com/woocommerce/woocommerce

CVE-2024-37297 · published 2024-06-12T19:40:16Z · modified 2026-09-10T03:50:15.338605138Z · JSON