Reflected Cross-Site Scripting Vulnerability in WooCommerce Coupons Plugin

CVE-2024-8541

Summary

The Discount Rules for WooCommerce plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) due to improper handling of input through the add_query_arg function. This vulnerability affects all versions up to and including 2.6.5, allowing attackers to craft malicious URLs that, when clicked by a site administrator, can lead to the execution of arbitrary web scripts. The vulnerability is specifically exploitable in scenarios where the 'Leave a Review' notice is displayed, a condition that typically occurs after the site has processed 100 orders. The security risk intensifies since this notice must be interacted with to trigger the attack, highlighting the importance of vigilance in site management.

References