CVE-2024-11324

Summary

CVE-2024-11324 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Accounting for WooCommerce plugin for WordPress. The issue arises due to the plugin's use of add_query_arg without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts into URLs. Successful attacks require users to click on a malicious link, executing the injected scripts in pages visited by the user. Versions up to and including 1.6.6 of the plugin are impacted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.