Unauthenticated reflected XSS in Facebook for WooCommerce

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

• Facebook for WooCommerce from Facebook, package facebook-for-woocommerce, is affected through 3.7.5, inclusive.
• The record sets default_status to unaffected and identifies 3.7.6 as the change point with status unaffected.
• The supplied scope covers only the named package and version boundary; the status of other Facebook or WooCommerce plugins, or other release branches, should not be inferred.

The flaw is classified as CWE-79 and affects the facebook-for-woocommerce plugin in Facebook for WooCommerce. The CNA maps it to reflected XSS, where attacker-controlled input can be reflected into generated web content without appropriate neutralization. The attack surface is network reachable, requires no authentication, and has low complexity, but exploitation requires a user to interact with affected content. The specific parameter, endpoint, rendering context, and escaping failure are not disclosed in the available evidence. The recorded scope crosses the boundary of the initially affected component, with limited effects on confidentiality, integrity, and availability; specific payloads and post-exploitation behavior are not established.

• The flaw is reachable over the network and does not require an account or authenticated privileges.
• The recorded complexity is low, but a user must interact with attacker-prepared content or a malicious link.
• The supplied record marks public exploit as false and does not provide a known-exploited status. The CISA enrichment record in GCVE assesses exploitation as none and automatable as no at the time of that assessment.
• Patchstack warns that the flaw is expected to become exploited. The available evidence does not identify a campaign, victim, payload, or confirmed incident.

• If successfully exploited, attacker-controlled script may execute in a user’s browser when the user interacts with affected content.
• Possible outcomes include altered page content, redirects, unwanted advertisements, or actions performed in the user’s website context. These are technical possibilities, not confirmed incidents.
• The record describes low impacts to confidentiality, integrity, and availability, with changed scope and required user interaction.
• The available evidence does not confirm administrative takeover, unauthorized server access, persistence, exfiltration, or a breach.

The flaw may allow website content to be altered, visitors to be redirected, or unwanted advertisements and HTML to be injected. Under some conditions, malicious script could affect user data or actions in the website context, but the record does not confirm data theft, administrative takeover, or a specific incident. Because user interaction is required, practical risk depends on whether malicious content reaches target users and whether they open or submit it. E-commerce sites may face reduced customer trust, disrupted browsing, and incident-response costs.

1. Update the WordPress Facebook for WooCommerce plugin to the latest available version, with 3.7.6 as the minimum version explicitly identified by the record as unaffected.
2. If an immediate update is not possible, apply Patchstack’s mitigation rule as a temporary control to block attacks until the update is completed. This does not replace upgrading the plugin.
3. After updating, recheck the inventory or deployment manifest to confirm that no installation remains within the affected boundary.
4. Review other WordPress sites in the organization and do not assume that other Facebook or WooCommerce plugins are fixed, because this record confirms only the Facebook for WooCommerce package.

1. Inventory WordPress sites running Facebook for WooCommerce and compare each installed version with the affected and fixed boundaries in the affected summary.
2. Confirm that the installed package is facebook-for-woocommerce, and verify its update status in WordPress Admin against the organization’s inventory or deployment manifest.
3. If Patchstack is deployed, review mitigation events associated with the plugin for blocked requests. Treat these as precautionary signals, not proof that exploitation occurred.
4. Review user reports and rendered site content for unexpected redirects, advertisements, or unfamiliar HTML/script content on plugin-generated pages. These are review signals, not confirmed indicators for this vulnerability.
5. The available evidence does not identify a specific endpoint, parameter, log event, or IOC. The absence of those signs does not prove that a deployment is safe.