Reflected Cross-Site Scripting Vulnerability in WooCommerce Additional Fees Plugin

CVE-2024-12395

Summary

CVE-2024-12395 is a reflected cross-site scripting vulnerability present in the WooCommerce Additional Fees On Checkout plugin for WordPress. The vulnerability arises from inadequate input sanitization and lack of output escaping with the 'number' parameter, which is present in all versions up to and including 1.4.7. This flaw allows unauthenticated attackers to craft malicious web scripts that can be executed in the context of a victim's browser if they are successfully enticed to click a specially crafted link. Website administrators using affected versions should prioritize updating their plugins to mitigate potential exploitation.

References