CVE-2014-6313

Published: Oct 14, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.

Affected (16)

Products: Woothemes: Woocommerce Plugin

Woothemes

1 product

Woocommerce Plugin

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Woothemes Woocommerce Plugin	Up to 2.2.2
Woothemes Woocommerce Plugin	Version 2.1.0
Woothemes Woocommerce Plugin	Version 2.1.10
Woothemes Woocommerce Plugin	Version 2.1.11
Woothemes Woocommerce Plugin	Version 2.1.12
Woothemes Woocommerce Plugin	Version 2.1.1
Woothemes Woocommerce Plugin	Version 2.1.2
Woothemes Woocommerce Plugin	Version 2.1.3
Woothemes Woocommerce Plugin	Version 2.1.4
Woothemes Woocommerce Plugin	Version 2.1.5
Woothemes Woocommerce Plugin	Version 2.1.6
Woothemes Woocommerce Plugin	Version 2.1.7
Woothemes Woocommerce Plugin	Version 2.1.8
Woothemes Woocommerce Plugin	Version 2.1.9
Woothemes Woocommerce Plugin	Version 2.2.0
Woothemes Woocommerce Plugin	Version 2.2.1