CVE-2014-6313

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-14 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.

Affected products

WooThemes Woocommerce Plugin: through 2.2.2; 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+9)

References

http://seclists.org/fulldisclosure/2014/Sep/59
http://secunia.com/advisories/61377
https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do
https://wordpress.org/plugins/woocommerce/changelog
http://seclists.org/fulldisclosure/2014/Sep/59
http://secunia.com/advisories/61377
https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do
https://wordpress.org/plugins/woocommerce/changelog

Get alerted when CVE-2014-6313 or the next vulnerability affects your stack