Reflected Cross-site Scripting Vulnerability in ACL Floating Cart for WooCommerce
CVE-2024-49640

7.1HIGH

Key Information:

Vendor

WordPress
Status
Acl Floating Cart For WooCommerce
Vendor
CVE Published:
29 October 2024

What is CVE-2024-49640?

A Cross-site Scripting (XSS) vulnerability exists in the ACL Floating Cart for WooCommerce plugin developed by AmaderCode Lab, enabling attackers to execute arbitrary scripts in the context of the user's browser. This security flaw allows for reflected XSS attacks, potentially compromising user data and session information. It affects versions from n/a to 0.9, making it imperative for users to update their plugin to mitigate any risk.

Affected Version(s)

ACL Floating Cart for WooCommerce 0 <= 0.9

References

https://patchstack.com/database/Wordpress/Plugin/acl-floa...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.