CVE-2021-24169: Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-79

Description

This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.

Affected products

AlgolPlus Advanced Order Export For WooCommerce (WordPress plugin): before 3.1.8 — fixed in 3.1.8

How to fix

Upgrade to a fixed version: AlgolPlus Advanced Order Export For WooCommerce (WordPress plugin) 3.1.8. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/164263/WordPress-Advanced-Order-Export-For-WooCommerce-3.1.7-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/09681a6c-57b8-4448-982a-fe8d28c87fc3
http://packetstormsecurity.com/files/164263/WordPress-Advanced-Order-Export-For-WooCommerce-3.1.7-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/09681a6c-57b8-4448-982a-fe8d28c87fc3

Get alerted when CVE-2021-24169 or the next vulnerability affects your stack