Reflected Cross-Site Scripting in Store Credit/Gift Cards for WooCommerce Plugin by WordPress

CVE-2024-11369

What is CVE-2024-11369?

The Store Credit / Gift Cards for WooCommerce plugin for WordPress is susceptible to a reflected cross-site scripting (XSS) vulnerability due to inadequate input sanitization and output escaping mechanisms. This flaw allows unauthenticated attackers to inject arbitrary web scripts into the pages, affecting users who interact with compromised links or inputs. Specifically, the vulnerability arises from the manipulation of the 'coupon', 'start_date', and 'end_date' parameters, impacting all versions up to and including 1.0.49.46.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References