Unauthorized Access via Reflected Cross-Site Scripting

CVE-2024-9377

Summary

The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to improper handling of user input with add_query_arg and remove_query_arg functions. This vulnerability exists in all versions up to and including 2.0.15, allowing unauthenticated attackers to inject malicious scripts into web pages. If users are manipulated into clicking deceptive links, these scripts can execute in their browsers, leading to potential site compromise and data exposure. Website administrators should apply patches or updates to enhance site security and prevent exploitation.

References