CVE-2022-0149— WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)
Quick assessment
Affected
Unknown WooCommerce – Store Exporter
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress plugin是WordPress开源的一个应用插件。 Wordpress Plugin WooCommerce 中存在跨站脚本漏洞，该漏洞源于产品的wooce admin页面未安全处理用户输入数据。攻击者可通过该漏洞导致客户端代码执行。以下产品及版本受到影响：Wordpress Plugin WooCommerce 2.7.1 之前版本。
Public Exploits 1
Nuclei · 1
CVE-2022-0149.yaml [template]
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-0149
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)
Source: CVE Program / CVE List V5
Vulnerability Description
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress plugin是WordPress开源的一个应用插件。 Wordpress Plugin WooCommerce 中存在跨站脚本漏洞，该漏洞源于产品的wooce admin页面未安全处理用户输入数据。攻击者可通过该漏洞导致客户端代码执行。以下产品及版本受到影响：Wordpress Plugin WooCommerce 2.7.1 之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WooCommerce – Store Exporter | 2.7.1 ~ 2.7.1 | - |
|
II. Public POCs for CVE-2022-0149
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | The plugin was affected by a reflected cross-site scripting vulnerability in the woo_ce admin page. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0149.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-0149
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-0149 (1)
-
https://plugins.trac.wordpress.org/changeset/2654545/woocommerce-exporter x_refsource_CONFIRM
Vendor Advisories for CVE-2022-0149 (1)
Same Patch Batch · Unknown · 2022-02-07 · 21 CVEs total
| CVE-2021-25004 | SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download | |
| CVE-2021-25095 | IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban | |
| CVE-2021-24839 | SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion | |
| CVE-2021-24878 | SupportCandy < 2.2.7 - Reflected Cross-Site Scripting | |
| CVE-2021-24843 | SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF | |
| CVE-2021-24879 | SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting | |
| CVE-2021-24880 | SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting | |
| CVE-2021-24928 | Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection | |
| CVE-2021-24993 | Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Upda | |
| CVE-2021-24947 | RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read | |
| CVE-2022-0148 | All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (X | |
| CVE-2021-25029 | Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting | |
| CVE-2021-25077 | Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting | |
| CVE-2021-25084 | Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion | |
| CVE-2021-25096 | IP2Location Country Blocker < 2.26.5 - Ban Bypass | |
| CVE-2021-25103 | GTranslate < 2.9.7 - Reflected Cross-Site Scripting | |
| CVE-2021-25105 | Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting | |
| CVE-2021-25106 | WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS | |
| CVE-2021-25114 | Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection | |
| CVE-2021-25108 | IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-107791
WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Dele -
CVE-2025-15703
WP Job Openings < 4.0.0 - Admin+ Stored XSS -
CVE-2026-84166
Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and -
CVE-2026-84167
Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclos -
CVE-2026-97183
WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Un
Same weakness: CWE-79
-
CVE-2026-92883
Improper Neutralization of Input During Web Page Generation -
CVE-2026-89117
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2026-76976
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-76975
Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support -
CVE-2026-76972
Cross-Site Scripting (XSS) vulnerability in SAP Manufacturin
V. Comments for CVE-2022-0149
No comments yet