CVE-2024-9170

Summary

CVE-2024-9170 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Booster for WooCommerce plugin for WordPress. Affecting versions up to and including 7.2.3, this issue allows authenticated attackers with ShopManager-level access or higher to inject malicious web scripts. These scripts will execute whenever an unsuspecting user accesses an injected page, posing a significant security risk. The root cause of this vulnerability is insufficient input sanitization and output escaping on user-supplied attributes within the plugin's wcj_product_meta shortcode.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.