Stored Cross-Site Scripting Vulnerability in WordPress Simple Shopping Cart Plugin

CVE-2024-12622

What is CVE-2024-12622?

The Simple Shopping Cart plugin for WordPress has a vulnerability that allows for stored cross-site scripting. This flaw arises from insufficient input sanitization and output escaping on attributes supplied by users. As a result, attackers who have contributor-level access or higher can exploit this vulnerability through the 'wp_cart_button' and 'wp_cart_display_product' shortcodes. When a vulnerable page is accessed, malicious scripts injected by an attacker may be executed in the context of the user's browser, leading to potential data theft or unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References