CVE-2024-56260

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Jan 2, 2025
CWE ID 79

Summary

CVE-2024-56260 is a Cross-site Scripting (XSS) vulnerability affecting ShopElement, a plugin used in StorePlugin ShopElement versions from n/a to 2.0.0. The flaw lies in the plugin's improper neutralization of user input during web page generation. An attacker can exploit this vulnerability to inject malicious scripts into a victim's web browser, potentially stealing sensitive data or taking control of the user's account. This issue poses a significant security risk and requires immediate attention from affected users, who should upgrade to a patched version of the plugin as soon as possible.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share