CVE-2019-18834

PoC —

CVSS 3.1

6.1 medium

EPSS

2%p75

Published

Jul 23, 2020 (Jul 23, 2020)

Modified

Jun 17, 2026

Description

Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.

Vendors: woocommerce
Products: subscriptions
Ecosystems: WordPress, E-commerce
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.