CVE-2024-12278

Summary

CVE-2024-12278 is a Stored Cross-Site Scripting (XSS) vulnerability in the Booster for WooCommerce plugin for WordPress. Affecting versions up to and including 7.2.5, this issue stems from insufficient input sanitization and output escaping in areas where data is typically sanitized using wp_kses, such as comments. Consequently, unauthenticated attackers can inject and execute arbitrary web scripts on pages accessed by unsuspecting users. This vulnerability poses a significant risk, as it allows malicious actors to manipulate content and potentially steal user data or install malware. Users are urged to update to the latest version of the plugin to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.