Is woocommerce/woocommerce affected by CVE-2024-37297?

Packagist woocommerce/woocommerce is affected in >=8.8.0 =8.9.0 <8.9.3.

Is CVE-2024-37297 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

medium

CVE-2024-37297

Q: Is CVE-2024-37297 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

Packagist · woocommerce/woocommerce

Summary

WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms

Severity: medium
EPSS: 0.5% (p38)
Also known as: GHSA-cv23-q6gh-xfrf
Published: 2024-06-12

References

https://github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf
https://nvd.nist.gov/vuln/detail/CVE-2024-37297
https://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.