CVE-2019-18834

Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.

• CWE-79

• https://woocommerce.com/products/woocommerce-subscriptions/Product, Vendor Advisory
• https://www.precursorsecurity.com/blogThird Party Advisory
• https://www.precursorsecurity.com/blog/woocommerce-subscriptions-persistent-xss-cve-2019-18834Exploit, Third Party Advisory
• https://woocommerce.com/products/woocommerce-subscriptions/Product, Vendor Advisory
• https://www.precursorsecurity.com/blogThird Party Advisory
• https://www.precursorsecurity.com/blog/woocommerce-subscriptions-persistent-xss-cve-2019-18834Exploit, Third Party Advisory

Published

Jul 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18829Barco ClickShare Button R9861500D01 devices before 1.10.0.13…7.8
• CVE-2019-1883A vulnerability in the command-line interface of Cisco Integ…7.8
• CVE-2019-18830Barco ClickShare Button R9861500D01 devices before 1.9.0 all…9.8
• CVE-2019-18831Barco ClickShare Button R9861500D01 devices before 1.9.0 all…5.3
• CVE-2019-18832Barco ClickShare Button R9861500D01 devices before 1.9.0 hav…8.1
• CVE-2019-18833Barco ClickShare Button R9861500D01 devices before 1.9.0 all…5.9
• CVE-2019-18835Matrix Synapse before 1.5.0 mishandles signature checking on…9.8
• CVE-2019-18836Envoy 1.12.0 allows a remote denial of service because of re…7.5
• CVE-2019-18837An issue was discovered in crun before 0.10.5. With a crafte…8.6
• CVE-2019-18838An issue was discovered in Envoy 1.12.0. Upon receipt of a m…7.5
• CVE-2019-18839FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin pa…9
• CVE-2019-1884A vulnerability in the web proxy functionality of Cisco Asyn…7.7