Lucene search

K
patchstackDave Jong (Patchstack)PATCHSTACK:D63BACB2B9DCA3426D1CD9922BCE60A3
HistoryAug 01, 2024 - 12:00 a.m.

WordPress WooCommerce PDF Vouchers Plugin < 4.9.5 is vulnerable to Cross Site Scripting (XSS)

2024-08-0100:00:00
Dave Jong (Patchstack)
patchstack.com
2
wordpress woocommerce pdf vouchers
cross site scripting
vulnerability
patch
cve-2024-39652
owasp a3

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.8

Confidence

High

Software

WooCommerce PDF Vouchers

Type

Plugin

Vulnerable versions

< 4.9.5

Fixed in

4.9.5

OWASP Top 10

A3: Injection

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-39652

Patch priority

Medium

CVSS severity

Medium (7.1)

Developer

Claim ownership

PSID

4bf7ebebf09d

Credits

Dave Jong Patchstack Dave Jong (Patchstack)

Required privilege

Unauthenticated

Published

1 August, 2024

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners
Node
-woocommerce_pdf_vouchersRange<4.9.5
VendorProductVersionCPE
-woocommerce_pdf_vouchers*cpe:2.3:a:-:woocommerce_pdf_vouchers:*:*:*:*:*:*:*:*

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.8

Confidence

High

Related for PATCHSTACK:D63BACB2B9DCA3426D1CD9922BCE60A3