WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-43213

7.1HIGH

Key Information:

Vendor
WordPress
Status
Wc Marketplace
Vendor
CVE Published:
12 August 2024

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the MultiVendorX WC Marketplace, which arises from improper neutralization of user input during the generation of web pages. This flaw allows an attacker to exploit the vulnerability by crafting a malicious URL that can execute arbitrary scripts within the context of the affected user's session. By targeting users of the WC Marketplace, attackers can potentially gain unauthorized access to sensitive information or perform actions on behalf of the user without their consent, thereby compromising the integrity and security of the application.

Affected Version(s)

WC Marketplace <= 4.1.17

References

https://patchstack.com/database/vulnerability/dc-woocomme...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

Credit

LVT-tholv2k (Patchstack Alliance)
.