-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key failures: 1) Lack of input sanitization when storing payment gateway titles (CWE-94), and 2) Lack of output escaping when displaying titles (CWE-116). The WC_Payment_Gateway class's process_admin_options method would handle settings storage, and get_title would handle display. In WooCommerce's architecture prior to 6.6.0, these methods likely directly used unsanitized user input from payment gateway configuration and output it without escaping, matching the described vulnerability pattern. The high confidence comes from the vulnerability description explicitly mentioning payment gateway titles and the standard WooCommerce payment gateway implementation patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| woocommerce/woocommerce | composer | < 6.6.0 | 6.6.0 |
PHPPHPOngoing coverage of React2Shell