WooCommerce plug-in 'calc _ shipping_state 'parameter HTML Injection Vulnerability

Release date:
Updated on: 2013-07-22

Affected Systems:
Woothemes WooCommerce
Description:
--------------------------------------------------------------------------------
Bugtraq id: 61365

WooCommerce is an e-commerce tool set plug-in for WordPress.

WooCommerce 2.0.12 has the HTML injection vulnerability. After successful exploitation, attackers can run the HTML and script code provided by attackers in the context of the affected browser to steal cookie authentication creden。 or control the appearance of the site.

<* Source: Mirza Burhan Baig
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Woothemes
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.woothemes.com/