Arbitrary Script Injection Vulnerability in Primer Plugin for WooCommerce

CVE-2024-11809

Summary

The Primer MyData for Woocommerce plugin for WordPress is exposed to a Reflected Cross-Site Scripting vulnerability through an inadequate verification of the 'img_src' parameter. Unsanitized input from this parameter allows potential attackers to inject arbitrary web scripts. If an unsuspecting user is misled into clicking a specially crafted link, the injected scripts may be executed within their browser session, leading to a range of harmful effects, including data theft and unauthorized actions. It is essential for users to apply protective measures immediately, including updating to patched versions of the plugin and enhancing input validation practices.

References