WordPress Plugin Vulnerable to Reflected Cross-Site Scripting
CVE-2024-11943

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
์›Œ๋“œํ”„๋ ˆ์Šค ๊ฒฐ์ œ ์‹ฌํ”ŒํŽ˜์ด โ€“ ์šฐ์ปค๋จธ์Šค ๊ฒฐ์ œ ํ”Œ๋Ÿฌ๊ทธ์ธ
Vendor
CVE Published:
7 December 2024

What is CVE-2024-11943?

The pgAll for WooCommerce plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability. This security flaw arises from the application of the add_query_arg function without sufficient URL escaping in all versions up to and including 5.2.2. As a result, unauthenticated attackers can exploit this weakness to inject arbitrary web scripts into web pages. If users are tricked into executing a certain action, such as clicking on a specifically crafted link, the injected scripts could execute within their browsers, potentially leading to compromising user data and sessions.

Affected Version(s)

์›Œ๋“œํ”„๋ ˆ์Šค ๊ฒฐ์ œ ์‹ฌํ”ŒํŽ˜์ด โ€“ ์šฐ์ปค๋จธ์Šค ๊ฒฐ์ œ ํ”Œ๋Ÿฌ๊ทธ์ธ * <= 5.2.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pgall-for-wooc...
https://wordpress.org/plugins/pgall-for-woocommerce/#deve...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Peter Thaleikis
JSON
.
CVE-2024-11943 : WordPress Plugin Vulnerable to Reflected Cross-Site Scripting