Read the docs
TI-2021-06461 Aliases CVE-2021-24169GHSA-w2gv-7447-6h8c

Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.

Why it matters now

EPSS 0.10348 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Advanced Order Export For WooCommerce (Unknown): 3.1.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Order Export For WooCommerce3.1.8 to before 3.1.83.1.8Patch availableCNA
  • Advanced Order Export For WooCommerce VendorUnknown Affected 3.1.8 to before 3.1.8 Fixed in 3.1.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:*:*:*:*:*:wordpress:*:*before 3.1.8VulnerableAlgolPlus
  • cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 3.1.8 Vulnerable ·AlgolPlus

Remediation

  • Fix · CNA Advanced Order Export For WooCommerce (Unknown) Fixed in 3.1.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24169
  2. 2026-10-03 Alias added: GHSA-w2gv-7447-6h8c

References

Exploit 2

  • TI-2024-10037 Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details CVSS 3.1CRITICAL 9.8
  • TI-2018-08240 The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. CVSS 3.0HIGH 7.8
  • TI-2020-09417 A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For… CVSS 3.1MEDIUM 6.1
  • TI-2022-19018 WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2021-08852 Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. CVSS 3.1MEDIUM 6.1
  • TI-2022-15953 Cross-site scripting in AlgolPlus Advanced Order Export For WooCommerce CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences