CVE-2024-9377
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Oct 10, 2024
Updated: Oct 15, 2024
CWE ID 79
Summary
CVE-2024-9377 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Products, Order & Customers Export plugin for WordPress, specifically versions up to and including 2.0.15. The issue arises due to the plugin's use of add_query_arg and remove_query_arg functions without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation of this vulnerability requires users to click on a maliciously crafted link, potentially leading to data theft or site takeover.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.