CVE-2024-12049
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Jan 7, 2025
CWE ID 79
Summary
CVE-2024-12049: The Woo Ukrposhta plugin for WordPress, affected up to version 1.17.11, contains a Reflected Cross-Site Scripting (XSS) vulnerability. This issue stems from insufficient input sanitization and output escaping on the 'order', 'post', and 'idd' parameters. Malicious actors can inject arbitrary web scripts into pages, potentially tricking users into clicking on a malicious link, and executing the harmful code. Unauthenticated attackers can exploit this vulnerability to conduct XSS attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.