CVE-2024-10837
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Nov 9, 2024
Updated: Nov 12, 2024
CWE ID 79
Summary
CVE-2024-10837 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the SysBasics Customize My Account plugin for WooCommerce in WordPress. Versions up to 2.7.29 are vulnerable due to insufficient input sanitization and output escaping of the 'tab' parameter. This issue allows unauthenticated attackers to inject arbitrary web scripts, potentially tricking users into clicking malicious links and executing the attacker's code on their pages.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.