Findings
- At over 43,000 lines of PHP this is a very large plugin, which makes it difficult to thoroughly assess
- Contains an XSS vulnerability: https://advisories.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do/
- Uses eval() and create_function() (i18n/makepot/extract/extract.php line 203, i18n/makepot/not-gettexted.php lines 73, 78, 111, i18n/makepot/pomo/po.php lines 168, i18n/makepot/pomo/translations.php line 171)
- In one instance where eval is used (i18n/makepot/extract/extract.php line 203) a comment above says “we can use eval safely, because we are sure $text is just a string literal” This is false, since $text is clearly taken from the output of token_get_all()
- Values are put into SQL unescaped (includes/abstracts/abstract-wc-product.php line 1191, includes/wc-order-functions.php line 26, etc)
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:
- Contains XSS vulnerability: https://advisories.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do/