What’s Vulnerable › Vulnerabilities

CVE-2022-50941: BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-01 · updated 2026-06-17
• Weakness: CWE-79

Description

BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkout input fields. Attackers can exploit unvalidated input parameters to execute arbitrary scripts, potentially leading to session hijacking, phishing attacks, and application module manipulation.

Affected products

• MrPlugins BootCommerce: 3.2.1

References

• https://codecanyon.net/item/bootcommerce-ecommerce-twitter-bootstrap-based/5702921
• https://www.vulncheck.com/advisories/bootcommerce-persistent-cross-site-scripting-via-order-checkout
• https://www.vulnerability-lab.com/get_content.php?id=2279
• https://www.vulnerability-lab.com/get_content.php?id=2279

Get alerted when CVE-2022-50941 or the next vulnerability affects your stack