Reflected XSS Vulnerability in YITH WooCommerce Product Add-Ons
CVE-2024-47367

7.1HIGH

Key Information:

Vendor
Yith
Status
Yith WooCommerce Product Add-ons
Vendor
CVE Published:
6 October 2024

Summary

A cross-site scripting (XSS) vulnerability exists in YITH WooCommerce Product Add-Ons, allowing attackers to execute arbitrary JavaScript in the context of the affected site. This issue occurs due to improper neutralization of input during web page generation, leading to potential reflections of harmful scripts back to users. This vulnerability can be exploited against users of versions prior to 4.13.0, putting sensitive user interactions and data at risk. Administrators using affected versions are urged to apply necessary updates to ensure their sites remain secure.

Affected Version(s)

YITH WooCommerce Product Add-Ons <= 4.13.0

References

https://patchstack.com/database/vulnerability/yith-woocom...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.