Clover Smart Online Order Vulnerable to Stored Cross-Site Scripting
CVE-2024-9895

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Smart Online Order For Clover
Vendor
CVE Published:
15 October 2024

Badges

📰 News Worthy

Summary

The Smart Online Order for Clover plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities. This issue originates from the plugin's moo_receipt_link shortcode, which lacks proper input sanitization and output escaping for user-supplied attributes. As a result, authenticated attackers possessing contributor-level access or higher can manipulate this shortcode to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious input, compromising user security and leading to potential unauthorized actions.

Affected Version(s)

Smart Online Order for Clover * <= 1.5.7

News Articles

favicon imageRecorded Future

CVE-2024-9895 Description, Impact and Technical Details

CVE-2024-9895 identifies a vulnerability in the Smart Online Order for Clover plugin for WordPress, affecting all versions up to and including 1.5.7. …

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/clover-online-orders/#devel...
https://plugins.trac.wordpress.org/browser/clover-online-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 📰

    First article discovered by Recorded Future

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.