Reflected Cross-Site Scripting in WooCommerce Payments Plugins by WordPress
CVE-2024-11362

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Payments Plugin And Checkout Plugin For WooCommerce: Stripe, Paypal, Square, Authorize.net
Vendor
CVE Published:
23 November 2024

What is CVE-2024-11362?

The Payments and Checkout Plugins for WooCommerce are prone to a reflected cross-site scripting vulnerability due to inadequate escaping of the URL parameters through the use of add_query_arg. This vulnerability affects all versions up to and including 1.112.0, allowing attackers to potentially execute arbitrary web scripts on user sessions. Attackers can exploit this flaw by tricking users into clicking specially crafted links, thereby executing malicious scripts within their browsers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net * <= 1.112.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/peachpay-for-w...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.