WordPress Plugin Vulnerable to Reflected Cross-Site Scripting
CVE-2024-11943
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 7 December 2024
What is CVE-2024-11943?
The pgAll for WooCommerce plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability. This security flaw arises from the application of the add_query_arg function without sufficient URL escaping in all versions up to and including 5.2.2. As a result, unauthenticated attackers can exploit this weakness to inject arbitrary web scripts into web pages. If users are tricked into executing a certain action, such as clicking on a specifically crafted link, the injected scripts could execute within their browsers, potentially leading to compromising user data and sessions.
Affected Version(s)
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 * <= 5.2.2