Reflected Cross-Site Scripting Vulnerability in Deliver via Shipos for WooCommerce Plugin by WordPress
CVE-2024-12222
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 9 January 2025
What is CVE-2024-12222?
The Deliver via Shipos for WooCommerce plugin for WordPress allows unauthenticated attackers to exploit a reflected cross-site scripting vulnerability through the 'dvsfw_bulk_label_url' parameter. This is due to inadequate input sanitization and output escaping mechanisms present in versions up to 2.1.7. If an attacker manages to deceive a user into clicking a crafted link, they can execute arbitrary web scripts, potentially compromising user data or session details.
Affected Version(s)
Deliver via Shipos for WooCommerce * <= 2.1.7