# WooCommerce: Persistent XSS via customer address (state/county)

WooCommerce 3.5.7 echoes customer state/county unencoded in admin user-edit page, letting a self-registered customer store XSS that fires for admins and yields RCE.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: foobar7
- Disclosed: 2019-05-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/530499
- Library page: https://bugbountylibrary.com/r/h1%3A530499
- Tags: area:web domain:web impact:ato impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:xss

**Target:** WordPress admin user-edit.php rendering of WooCommerce billing address
**Root cause:** WooCommerce echoes the customer's state/county value into the admin backend without HTML encoding, so stored markup executes in the admin's browser.
**Steps:**
1. Register/open a customer account and log in at /my-account/.
2. At checkout select UK as country and set County to `'"><img src=x onerror=alert(1) x=y` (missing `>` because tags are filtered), or edit address at /my-account/edit-address/.
3. As admin visit /wp-admin/users.php and click the customer, or /wp-admin/user-edit.php?user_id=4.
4. Payload executes in admin context.
**How found:** Noticed the state/county value is echoed unencoded in the admin backend; tested that tags are filtered but a missing `>` in the img payload bypasses the filter.
**Exploitation:** Attacker with a low-priv customer account stores the payload in the county field; when an administrator views the customer's profile in wp-admin the script runs in the admin session, allowing arbitrary admin requests such as editing a plugin file to achieve server-side code execution.
**Escalation:** Stored XSS in admin session chained to editing a WordPress plugin file for RCE on default setups.
**Insight:** WooCommerce address fields (state/county) are rendered in admin user-edit screens; test filter bypasses by omitting the closing `>` so the tag is reconstructed by the browser.