Stored DOM-Based Cross-Site Scripting Vulnerability in Finale Lite Plugin by WordPress

CVE-2024-12589

What is CVE-2024-12589?

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin is susceptible to Stored DOM-Based Cross-Site Scripting vulnerabilities due to inadequate input sanitization and output escaping mechanisms. This flaw permits authenticated users, with Contributor-level permissions and higher, to inject malicious web scripts into the countdown timer feature. Consequently, these scripts may execute on user pages whenever accessed, posing significant risks to site security and user integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References