XStore vulnerable to Cross-site Scripting (XSS)

CVE-2024-33562

What is CVE-2024-33562?

An improper neutralization of input during web page generation has been identified in the XStore theme by 8theme, leading to a reflected Cross-site Scripting (XSS) vulnerability. This flaw enables attackers to inject and execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking or redirection to malicious sites. Users running versions of XStore from n/a up to 9.3.5 are particularly at risk, highlighting the necessity for updates and security measures.

References