Commit 5b8d60ae268 for woocommerce
commit 5b8d60ae26812c58eab4db1998672b5cafcdc919
Author: woocommercebot <30233865+woocommercebot@users.noreply.github.com>
Date: Tue Mar 10 15:09:48 2026 +0000
[Backport to trunk] Apply patch 440 (#63617)
Apply patch 440 (#63616)
Co-authored-by: Taha Paksu <3295+tpaksu@users.noreply.github.com>
diff --git a/plugins/woocommerce/changelog/opr-fix-receipt-note-xss b/plugins/woocommerce/changelog/opr-fix-receipt-note-xss
new file mode 100644
index 00000000000..f5b44b5c454
--- /dev/null
+++ b/plugins/woocommerce/changelog/opr-fix-receipt-note-xss
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Prevent stored XSS on order notes added via REST API
diff --git a/plugins/woocommerce/includes/rest-api/Controllers/Version1/class-wc-rest-order-notes-v1-controller.php b/plugins/woocommerce/includes/rest-api/Controllers/Version1/class-wc-rest-order-notes-v1-controller.php
index b057cfda816..33e2a43ec99 100644
--- a/plugins/woocommerce/includes/rest-api/Controllers/Version1/class-wc-rest-order-notes-v1-controller.php
+++ b/plugins/woocommerce/includes/rest-api/Controllers/Version1/class-wc-rest-order-notes-v1-controller.php
@@ -66,9 +66,10 @@ class WC_REST_Order_Notes_V1_Controller extends WC_REST_Controller {
'permission_callback' => array( $this, 'create_item_permissions_check' ),
'args' => array_merge( $this->get_endpoint_args_for_item_schema( WP_REST_Server::CREATABLE ), array(
'note' => array(
- 'type' => 'string',
- 'description' => __( 'Order note content.', 'woocommerce' ),
- 'required' => true,
+ 'type' => 'string',
+ 'description' => __( 'Order note content.', 'woocommerce' ),
+ 'required' => true,
+ 'sanitize_callback' => 'wp_kses_post',
),
) ),
),
diff --git a/plugins/woocommerce/src/Internal/ReceiptRendering/Templates/order-receipt.php b/plugins/woocommerce/src/Internal/ReceiptRendering/Templates/order-receipt.php
index 264c20108c0..366adcfa8d9 100644
--- a/plugins/woocommerce/src/Internal/ReceiptRendering/Templates/order-receipt.php
+++ b/plugins/woocommerce/src/Internal/ReceiptRendering/Templates/order-receipt.php
@@ -49,7 +49,7 @@
<?php if ( ! empty( $data['notes'] ) ) { ?>
<h3 id="order_notes_section_title"><?php echo strtoupper( $data['texts']['order_notes_section_title'] ); ?></h3>
<?php foreach ( $data['notes'] as $note ) { ?>
- <p><?php echo $note; ?></p>
+ <p><?php echo wp_kses_post( $note ); ?></p>
<?php
}
}
diff --git a/plugins/woocommerce/templates/myaccount/view-order.php b/plugins/woocommerce/templates/myaccount/view-order.php
index d851b760284..2a3862a6a3f 100644
--- a/plugins/woocommerce/templates/myaccount/view-order.php
+++ b/plugins/woocommerce/templates/myaccount/view-order.php
@@ -14,7 +14,7 @@
*
* @see https://woocommerce.com/document/template-structure/
* @package WooCommerce\Templates
- * @version 10.1.0
+ * @version 10.6.0
*/
defined( 'ABSPATH' ) || exit;
@@ -56,7 +56,7 @@ echo wp_kses_post(
<div class="woocommerce-OrderUpdate-text comment-text">
<p class="woocommerce-OrderUpdate-meta meta"><?php echo date_i18n( esc_html__( 'l jS \o\f F Y, h:ia', 'woocommerce' ), strtotime( $note->comment_date ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></p>
<div class="woocommerce-OrderUpdate-description description">
- <?php echo wpautop( wptexturize( $note->comment_content ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
+ <?php echo wp_kses_post( wpautop( wptexturize( $note->comment_content ) ) ); ?>
</div>
<div class="clear"></div>
</div>
diff --git a/plugins/woocommerce/templates/order/tracking.php b/plugins/woocommerce/templates/order/tracking.php
index 9862ed49487..fe3b2d792cd 100644
--- a/plugins/woocommerce/templates/order/tracking.php
+++ b/plugins/woocommerce/templates/order/tracking.php
@@ -12,7 +12,7 @@
*
* @see https://woocommerce.com/document/template-structure/
* @package WooCommerce\Templates
- * @version 10.1.0
+ * @version 10.6.0
*/
defined( 'ABSPATH' ) || exit;
@@ -54,7 +54,7 @@ $notes = $order->get_customer_order_notes();
<div class="comment-text">
<p class="meta"><?php echo date_i18n( esc_html__( 'l jS \o\f F Y, h:ia', 'woocommerce' ), strtotime( $note->comment_date ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></p>
<div class="description">
- <?php echo wpautop( wptexturize( $note->comment_content ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
+ <?php echo wp_kses_post( wpautop( wptexturize( $note->comment_content ) ) ); ?>
</div>
<div class="clear"></div>
</div>