CVE-2024-9345

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Oct 4, 2024
Updated: Oct 8, 2024
CWE ID 79

Summary

CVE-2024-9345 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.7.3 and below of the WooCommerce – Lite plugin for WordPress. The issue lies in the use of the function add_query_arg without proper escaping on URL parameters, allowing attackers to inject arbitrary web scripts. Unauthenticated attackers can exploit this vulnerability by tricking users into clicking malicious links. The exploit is only successful when WordPress notices are present.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share