Executive brief
WooCommerce Designer Pro is a WordPress plugin that allows customers to customize products in an online store. A security vulnerability in this plugin allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. If an administrator or another visitor views the affected area, these scripts could be used to redirect users to malicious sites, display unauthorized advertisements, or potentially steal session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the WooCommerce Designer Pro plugin for WordPress (versions up to and including 1.9.34). The flaw is caused by improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with Subscriber-level privileges can inject malicious scripts that execute in the context of a victim's browser, typically requiring a more privileged user (such as an administrator) to interact with the affected page. This is a stored XSS vulnerability that can lead to unauthorized redirects, advertisement injection, or session hijacking. The issue is resolved in version 1.9.35.
Affected products
- WooCommerce Designer Pro WooCommerce Designer Pro <= 1.9.34
Timeline
- 2026-04-14: other: Reported by Nguyen Ba Khanh
- 2026-06-29: advisory: Published by Patchstack and NVD
- 2026-06-29: patched: Version 1.9.35 released to address the vulnerability