Lucene search

WPScanVULNRICHMENT:CVE-2024-7846

HistorySep 23, 2024 - 6:00 a.m.

CVE-2024-7846 YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS

2024-09-2306:00:01

WPScan

github.com

cve-2024-7846

yith woocommerce ajax search

xss

vulnerability

contributors+ attackers

injection

AI Score

6.1

Confidence

High

EPSS

Percentile

9.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:yithemes:yith_woocommerce_ajax_search:-:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "yithemes",
    "product": "yith_woocommerce_ajax_search",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/86f7a136-d09b-4637-97ae-2cdaaff172a3/