# CVE-2024-37297: woocommerce XSS — Fixed in 8.8.5

🐘

🐘 Packagist

Not in CISA KEV

MEDIUM severity

# CVE-2024-37297 — woocommerce

MEDIUM [Fix: woocommerce/woocommerce@0e98883](https://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4)

CVE-2024-37297 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in woocommerce/woocommerce. A fix is available for woocommerce/woocommerce — see the affected versions and patch details below.

WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms

Also known as[GHSA-cv23-q6gh-xfrf](/vulnerability/GHSA-cv23-q6gh-xfrf)

Published

Jun 12, 2024

Updated

Nov 11, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-37297.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs42th percentile — riskier than 42% of all scored CVEsHighest risk

0.00%0.55%1.10%1.64%1.1%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

2 pkgs affected

🐘`woocommerce/woocommerce`🐘`woocommerce/woocommerce`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

#### Impact

A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the Sourcebuster.js library and then inserted without proper sanitization to the classic checkout and registration forms.

#### Patches

```
diff --git a/plugins/woocommerce/client/legacy/js/frontend/order-attribution.js b/plugins/woocommerce/client/legacy/js/frontend/order-attribution.js
index 79411e928e1..25eaa721c54 100644
--- a/plugins/woocommerce/client/legacy/js/frontend/order-attribution.js
+++ b/plugins/woocommerce/client/legacy/js/frontend/order-attribution.js
@@ -155,12 +155,16 @@
 		 * but it's not yet supported in Safari.
 		 */
 		connectedCallback() {
-			let inputs = '';
+			this.innerHTML = '';
+			const inputs = new DocumentFragment();
 			for( const fieldName of this._fieldNames ) {
-				const value = stringifyFalsyInputValue( this.values[ fieldName ] );
-				inputs += `<input type="hidden" name="${params.prefix}${fieldName}" value="${value}"/>`;
+				const input = document.createElement( 'input' );
+				input.type = 'hidden';
+				input.name = `${params.prefix}${fieldName}`;
+				input.value = stringifyFalsyInputValue( ( this.values && this.values[ fieldName ] ) || '' );
+				inputs.appendChild( input );
 			}
-			this.innerHTML = inputs;
+			this.appendChild( inputs );
 		}
 
 		/**
```

#### Workarounds

Disabling the Order Attribution feature

#### References

A8C SIRT: p3btAN-2L2-p2 (internal) Public disclosure: [https://developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0/](https://developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0/)

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`woocommerce/woocommerce` 

≥ 8.8.0&&< 8.8.5

8.8.5`composer require woocommerce/woocommerce:^8.8.5`

🐘Packagist

`woocommerce/woocommerce` 

≥ 8.9.0&&< 8.9.3

8.9.3`composer require woocommerce/woocommerce:^8.9.3`

## Affected Products

1 product · 2 configurations

Application

`woocommerce`woocommerce

≥ 8.9.0 && < 8.9.3

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for woocommerce/woocommerce, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update woocommerce/woocommerce to 8.8.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-37297 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

\### Impact A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the Sourcebuster.js library and then inserted without proper sanitization to the classic checkout and registration forms. ### Patches \`\`\`diff diff --git a/plugins/woocommerce/client/legacy/js/

O3 Security · Impact-Aware SCA

### Is CVE-2024-37297 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)