Reflected XSS Vulnerability in YITH WooCommerce Product Add-Ons

CVE-2024-47367

What is CVE-2024-47367?

A cross-site scripting (XSS) vulnerability exists in YITH WooCommerce Product Add-Ons, allowing attackers to execute arbitrary JavaScript in the context of the affected site. This issue occurs due to improper neutralization of input during web page generation, leading to potential reflections of harmful scripts back to users. This vulnerability can be exploited against users of versions prior to 4.13.0, putting sensitive user interactions and data at risk. Administrators using affected versions are urged to apply necessary updates to ensure their sites remain secure.

References