CVE-2024-9217

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Mar 1, 2025

CWE ID 79

Summary

CVE-2024-9217 is a Reflected Cross-Site Scripting vulnerability affecting the Currency Switcher plugin for WooCommerce on WordPress. Versions up to and including 2.16.2 are impacted. This issue arises due to the plugin's use of add_query_arg without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation occurs when users are tricked into clicking on a malicious link, potentially leading to the execution of the injected code on affected pages.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Currency Switcher For Woocommerce Plugin

Affected Vendors

WordPress

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/315Fzx
https://www.cve.org/CVERecord?id=CVE-2024-9217
https://nvd.nist.gov/vuln/detail/CVE-2024-9217

Back to Vulnerability Database

Platform Features

Products

Use Cases

Teams

Industries

Services

Measuring the US-China AI Gap

TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered

Uncovering MintsLoader With Recorded Future Malware Intelligence Hunting

Know What Matters

For Customers

For Partners