Reflected Cross-Site Scripting Vulnerability in WooCommerce Digital Content Delivery Plugin

CVE-2024-12438

Summary

The WooCommerce Digital Content Delivery (FlickRocket) plugin for WordPress suffers from a reflected cross-site scripting vulnerability. This issue arises from inadequate input sanitization and output escaping on the 'start_date' and 'end_date' parameters. An unauthenticated attacker can exploit this flaw to inject arbitrary web scripts into web pages viewed by users. If the victim is manipulated into engaging with a crafted link, the malicious script will execute in their browser context, potentially facilitating various attacks, including data theft and session hijacking.

References