CVE-2024-13708
CVSS 3.1 Score 7.2 of 10 (high)
Details
Published Apr 4, 2025
Updated: Apr 9, 2025
CWE ID 434
Summary
CVE-2024-13708 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Booster for WooCommerce plugin used with WordPress. Versions 4.0.1 to 7.2.4 are susceptible to this issue. The flaw stems from insufficient input sanitization and output escaping during SVG file uploads, enabling unauthenticated attackers to inject malicious web scripts. These scripts will execute when a user accesses the affected SVG file, posing a significant threat to website security.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Booster