What’s Vulnerable › Vulnerabilities

CVE-2019-9168

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-02-26 · updated 2026-06-17
• Weakness: CWE-79

Description

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.

Affected products

• Automattic WooCommerce: before 3.5.5 — fixed in 3.5.5

How to fix

Upgrade to a fixed version: Automattic WooCommerce 3.5.5. Check the vendor advisory for mitigations.

References

• https://woocommerce.wordpress.com/2019/02/20/woocommerce-3-5-5-security-fix-release/
• https://woocommerce.wordpress.com/2019/02/20/woocommerce-3-5-5-security-fix-release/

Get alerted when CVE-2019-9168 or the next vulnerability affects your stack