Read the docs
TI-2014-05191 Aliases CVE-2014-6313GHSA-wq8m-rc75-vf5c

Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.

Why it matters now

EPSS 0.02023 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:woothemes:woocommerce_plugin:*:*:*:*:*:wordpress:*:*up to 2.2.2VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.0:*:*:*:*:wordpress:*:*2.1.0VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.1:*:*:*:*:wordpress:*:*2.1.1VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.2:*:*:*:*:wordpress:*:*2.1.2VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.3:*:*:*:*:wordpress:*:*2.1.3VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.4:*:*:*:*:wordpress:*:*2.1.4VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.5:*:*:*:*:wordpress:*:*2.1.5VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.6:*:*:*:*:wordpress:*:*2.1.6VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.7:*:*:*:*:wordpress:*:*2.1.7VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.8:*:*:*:*:wordpress:*:*2.1.8VulnerableWooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:*:*:*:*:*:wordpress:*:* Versions up to 2.2.2 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.0:*:*:*:*:wordpress:*:* Versions 2.1.0 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.1:*:*:*:*:wordpress:*:* Versions 2.1.1 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.2:*:*:*:*:wordpress:*:* Versions 2.1.2 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.3:*:*:*:*:wordpress:*:* Versions 2.1.3 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.4:*:*:*:*:wordpress:*:* Versions 2.1.4 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.5:*:*:*:*:wordpress:*:* Versions 2.1.5 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.6:*:*:*:*:wordpress:*:* Versions 2.1.6 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.7:*:*:*:*:wordpress:*:* Versions 2.1.7 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.8:*:*:*:*:wordpress:*:* Versions 2.1.8 Vulnerable ·WooThemes
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.9:*:*:*:*:wordpress:*:*2.1.9VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.10:*:*:*:*:wordpress:*:*2.1.10VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.11:*:*:*:*:wordpress:*:*2.1.11VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.1.12:*:*:*:*:wordpress:*:*2.1.12VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.2.0:*:*:*:*:wordpress:*:*2.2.0VulnerableWooThemes
cpe:2.3:a:woothemes:woocommerce_plugin:2.2.1:*:*:*:*:wordpress:*:*2.2.1VulnerableWooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.9:*:*:*:*:wordpress:*:* Versions 2.1.9 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.10:*:*:*:*:wordpress:*:* Versions 2.1.10 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.11:*:*:*:*:wordpress:*:* Versions 2.1.11 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.1.12:*:*:*:*:wordpress:*:* Versions 2.1.12 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.2.0:*:*:*:*:wordpress:*:* Versions 2.2.0 Vulnerable ·WooThemes
  • cpe:2.3:a:woothemes:woocommerce_plugin:2.2.1:*:*:*:*:wordpress:*:* Versions 2.2.1 Vulnerable ·WooThemes

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-6313
  2. 2026-10-03 Alias added: GHSA-wq8m-rc75-vf5c

References

Exploit 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences