CVE-2022-2099

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles

We have discovered 172,141 live websites that are affected by CVE-2022-2099.

Run a Free Instant Scan



Affected Software

Product  WooCommerce
Category Ecommerce
Vulnerable Domains172,141 live websites (16% of WooCommerce install base)
Vulnerable Versions
  • from 0 through 6.6
Vulnerable Versions Count305 versions ( 58% of all versions)


Common Weakness Enumeration

CWE-116 Improper Encoding or Escaping of Output



Details

  • Published - Jul 17, 2022
  • Updated - Aug 3, 2024

Credits

  • Taurus Omar (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2022-2099
United States37,074 websites


Germany12,068 websites
Italy10,560 websites
Russia10,040 websites
France9,412 websites
GB7,671 websites
Vietnam6,433 websites
Spain5,977 websites
Poland4,671 websites
Netherlands4,463 websites

Website Distribution by TLD

Number of websites using CVE-2022-2099
.com72,301 websites
.ru7,879 websites
.it7,048 websites
.de4,779 websites
.co.uk4,495 websites
.org4,107 websites
.nl3,565 websites
.pl3,490 websites
.fr3,419 websites
.net3,296 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-2099

Top websites that are affected by CVE-2022-2099. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.com United States*,***
*****************.com United States*,***
*************.com United States*,***
*********.com United States*,***
**********.com United States*,***
*********.com Netherlands**,***
********.gr Greece**,***
************.com United States**,***
*************.net Vietnam**,***
***************.***.au Australia**,***
See full domain list

FAQ

CVE-2022-2099 is Improper Encoding or Escaping of Output in WooCommerce
A total of 172,141 websites have been identified as vulnerable to CVE-2022-2099, based on global website indexing conducted by WebTechSurvey.
The WooCommerce is affected by the CVE-2022-2099 vulnerability.
WooCommerce versions up to 6.6 are vulnerable to CVE-2022-2099.
CVE-2022-2099 is resolved in version 6.6 of WooCommerce.