CVE-2024-9239mediumCWE-79

CVE-2024-9239: fallo de gravedad media en pluggabl Booster for WooCommerce – PDF…

Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.4%
The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
pluggabl · Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
CVEs relacionadas — pluggabl Booster for WooCommerce – PDF…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3957MEDIUMBooster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.9%CVE-2023-4796MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via ShortcodeEPSS 0.7%CVE-2024-13342HIGHBooster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File UploadEPSS 0.7%CVE-2023-4945MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2023-5638MEDIUMBooster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-9170MEDIUMBooster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta ShortcodeEPSS 0.5%