CVE-2024-52398

CVE-2024-52398 affects the WordPress plugin CDI (Collect and Deliver Interface for WooCommerce) with versions up to and including 5.5.3. The vulnerability is Unrestricted Upload of File with Dangerous Type, enabling arbitrary file uploads. Public references in Red Hat advisories and Patchstack co...

CDI < 5.1.9 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting...