Reflected Cross-Site Scripting in Woo Ukrposhta Plugin for WordPress

CVE-2024-12049

Summary

The Woo Ukrposhta plugin for WordPress is susceptible to reflected cross-site scripting, allowing unauthenticated attackers to exploit the 'order', 'post', and 'idd' parameters. This vulnerability arises from inadequate input sanitization and output escaping, resulting in the potential injection of arbitrary web scripts. Attackers may trick users into executing malicious scripts by enticing them to click on specially crafted links, thereby compromising the integrity of the affected websites.

References