Reflected Cross-Site Scripting Vulnerability in G Web Pro Store Locator Plugin for WordPress

CVE-2024-11682

Summary

CVE-2024-11682 is a high-risk Reflected Cross-Site Scripting (XSS) vulnerability found in the G Web Pro Store Locator plugin for WordPress. It arises from inadequate input sanitization and output escaping in the handling of the 'q' parameter. This vulnerability allows unauthenticated attackers to inject malicious web scripts into web pages. The exploitation hinges on the attacker successfully deceiving a user into clicking a specially crafted link, potentially leading to session hijacking, user data theft, or redirection to malicious sites. All versions of the plugin up to and including 2.1 are affected, emphasizing the need for timely patching and security measures.

References