CVE-2024-11369

Summary

CVE-2024-11369 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Store credit / Gift cards plugin for WordPress, specifically versions up to and including 1.0.49.46. This issue stems from insufficient input sanitization and output escaping for the 'coupon', 'start_date', and 'end_date' parameters. Consequently, unauthenticated attackers can inject arbitrary web scripts, which may execute if a user is tricked into performing a specified action, like clicking a malicious link. Successful exploitation of this vulnerability could lead to various forms of website takeover or data theft. To mitigate this risk, it is recommended that affected WordPress sites be updated to the latest available plugin version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.