Reflected Cross-Site Scripting Vulnerability in Deliver via Shipos for WooCommerce Plugin by WordPress
CVE-2024-12222

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Deliver Via Shipos For WooCommerce
Vendor
CVE Published:
9 January 2025

Summary

The Deliver via Shipos for WooCommerce plugin for WordPress allows unauthenticated attackers to exploit a reflected cross-site scripting vulnerability through the 'dvsfw_bulk_label_url' parameter. This is due to inadequate input sanitization and output escaping mechanisms present in versions up to 2.1.7. If an attacker manages to deceive a user into clicking a crafted link, they can execute arbitrary web scripts, potentially compromising user data or session details.

Affected Version(s)

Deliver via Shipos for WooCommerce * <= 2.1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/wc-shipos-delivery/#developers

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.