WooCommerce Cart Count Shortcode Vulnerable to Stored XSS

CVE-2024-12517

What is CVE-2024-12517?

The WooCommerce Cart Count Shortcode plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in the 'cart_button' shortcode. This vulnerability allows authenticated attackers, who possess contributor-level access or higher, to inject arbitrary JavaScript code into pages that will execute when other users view these compromised pages. This flaw can lead to unauthorized actions, data theft, or defacement of a website, posing a significant risk to the integrity and security of the affected WordPress installations.

References