Reflected Cross-Site Scripting in WooCommerce Checkout Field Editor by WordPress
CVE-2024-8499

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Checkout Field Editor (checkout Manager) For WooCommerce
Vendor
CVE Published:
4 October 2024

What is CVE-2024-8499?

The Checkout Field Editor (Checkout Manager) for WooCommerce, developed for WordPress, is susceptible to reflected cross-site scripting (XSS) threats due to inadequate input sanitization and output escaping in the 'render_review_request_notice' function. This vulnerability allows unauthenticated attackers to inject malicious web scripts into pages. If a user is tricked into clicking a specially crafted link, the injected scripts could execute, leading to potential data theft or unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Checkout Field Editor (Checkout Manager) for WooCommerce * <= 2.0.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woo-checkout-f...
https://plugins.trac.wordpress.org/changeset/3160299/

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.