Reflected Cross-Site Scripting in WooCommerce Payments Plugins by WordPress
CVE-2024-11362

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
WooCommerce Payments Plugin
Vendor
CVE Published:
23 November 2024

What is CVE-2024-11362?

The Payments and Checkout Plugins for WooCommerce are prone to a reflected cross-site scripting vulnerability due to inadequate escaping of the URL parameters through the use of add_query_arg. This vulnerability affects all versions up to and including 1.112.0, allowing attackers to potentially execute arbitrary web scripts on user sessions. Attackers can exploit this flaw by tricking users into clicking specially crafted links, thereby executing malicious scripts within their browsers.

References

https://plugins.trac.wordpress.org/browser/peachpay-for-w...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.