WordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-54231

7.1HIGH

Key Information:

Vendor
WordPress
Status
Ni WooCommerce Order Export
Vendor
CVE Published:
13 December 2024

Summary

A Cross-Site Scripting vulnerability has been identified within Anzia's Ni WooCommerce Order Export plugin. This flaw arises from improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that can be executed in the context of the user's browser. The exploitation of this vulnerability could enable unauthorized actions, such as stealing sensitive information or perpetuating further attacks. Users operating Ni WooCommerce Order Export versions 3.1.6 and earlier are advised to take immediate precautions to ensure their systems remain secure.

Affected Version(s)

Ni WooCommerce Order Export <= 3.1.6

References

https://patchstack.com/database/wordpress/plugin/ni-wooco...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thiennv (Patchstack Alliance)
.