WordPress Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-9608

What is CVE-2024-9608?

The MyParcel plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability stemming from the insufficient escaping of parameters processed by add_query_arg. This flaw is present in all versions up to and including 4.24.1. An attacker can exploit this vulnerability by manipulating the URL, injecting arbitrary web scripts that are executed in the context of the user’s browser upon interaction with affected pages. This risk is notably exploitable when WooCommerce is configured for operations within Belgium, making it critical for site administrators to apply necessary upgrades and implement security best practices.

References