Stored Cross-Site Scripting Vulnerability in WordPress Simple Shopping Cart Plugin

CVE-2024-12622

Summary

The Simple Shopping Cart plugin for WordPress has a vulnerability that allows for stored cross-site scripting. This flaw arises from insufficient input sanitization and output escaping on attributes supplied by users. As a result, attackers who have contributor-level access or higher can exploit this vulnerability through the 'wp_cart_button' and 'wp_cart_display_product' shortcodes. When a vulnerable page is accessed, malicious scripts injected by an attacker may be executed in the context of the user's browser, leading to potential data theft or unauthorized actions.

References