CVE-2022-50941
BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 1, 2026
- Updated
- Feb 3, 2026
- Reserved
- Jan 11, 2026
Description
BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkout input fields. Attackers can exploit unvalidated input parameters to execute arbitrary scripts, potentially leading to session hijacking, phishing attacks, and application module manipulation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
BootCommerceMrPlugins |
|
References
- Vulnerability Lab Advisoryexploit
- Product Homepageproduct
- VulnCheck Advisory: BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkoutthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.