CVE-2024-11225

Summary

CVE-2024-11225 is a Reflected Cross-Site Scripting vulnerability affecting the Premium Packages – Sell Digital Products Securely plugin for WordPress. The flaw, present in all versions up to 5.9.3, stems from the plugin's use of add_query_arg without proper escaping on URLs. This weakness enables unauthenticated attackers to inject arbitrary web scripts into pages. Successful exploitation requires users to perform specific actions, such as clicking on malicious links, allowing attackers to execute their malicious code.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.