CVE-2023-4945 in Booster for WooCommerce Plugin
Summary
by MITRE • 09/14/2023
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-4945 affects the Booster for WooCommerce plugin, a popular WordPress extension that enhances e-commerce functionality. This plugin, designed to provide additional features for WooCommerce stores, contains a critical stored cross-site scripting vulnerability that impacts versions up to and including 7.1.0. The flaw exists within the plugin's handling of multiple shortcodes, which are used to embed dynamic content and functionality throughout WordPress sites. Attackers exploiting this vulnerability can manipulate the plugin's shortcode processing mechanisms to inject malicious scripts that persist in the database and execute whenever affected pages are accessed.
The technical root cause of this vulnerability stems from inadequate input sanitization and output escaping practices within the plugin's shortcode implementation. When administrators or users with contributor-level permissions and above utilize the plugin's shortcodes, the system fails to properly validate or sanitize user-supplied attributes before storing them in the database. This insufficient validation creates a persistent XSS vector where malicious payloads can be stored and executed across multiple user sessions. The vulnerability specifically targets the plugin's shortcode attributes, which are commonly used to configure dynamic content display and functionality within WooCommerce stores.
The operational impact of this vulnerability is significant for WordPress sites utilizing the affected plugin version. Attackers with contributor-level access or higher can inject malicious scripts that execute in the context of any user who views pages containing the stored payloads. This creates a persistent threat where malicious code can compromise user sessions, steal sensitive data, or redirect users to malicious websites. The vulnerability affects all users who access pages containing the injected content, making it particularly dangerous for sites with multiple contributors or administrators who may inadvertently view compromised pages. The stored nature of the vulnerability means that once injected, malicious scripts remain active until manually removed from the database.
This vulnerability aligns with CWE-79 which describes Cross-Site Scripting flaws occurring when user-provided data is not properly sanitized before being included in web pages. The specific attack pattern corresponds to CWE-80 which addresses situations where user-controllable input is directly included in output without proper escaping or encoding. From an adversarial perspective, this vulnerability maps to ATT&CK technique T1566.001 which involves social engineering through malicious links or content injection, and T1059.001 which covers command and scripting interpreter usage. Organizations should immediately update to the patched version of the Booster for WooCommerce plugin to prevent exploitation, while also implementing additional security measures such as restricting contributor permissions and monitoring for suspicious shortcode usage patterns. The vulnerability demonstrates the critical importance of proper input validation and output escaping in web applications, particularly in content management systems where multiple user roles may interact with plugin functionality.