Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-9384

Summary

The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is exposed to Reflected Cross-Site Scripting due to an improper implementation of the add_query_arg function without sufficient escaping mechanisms. This vulnerability allows unauthenticated attackers to inject arbitrary scripts into web pages. If exploited, this could lead to significant security risks, such as the execution of malicious scripts when a user interacts with a crafted link. It's crucial for users of WooCommerce to update their plugins to ensure they are not vulnerable to such exploits.

References