CVE-2024-0678: Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting
The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects the version of the "order-delivery-date" plugin for WP Ecommerce which was hosted in the WordPress repository and is discontinued now. The version of the plugin hosted off of the repository titled 'Order Delivery Date' for WooCommerce is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0678?
CVE-2024-0678 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-0678?
To fix CVE-2024-0678, update the Order Delivery Date for WP e-Commerce plugin to version 1.3 or later.
Which versions are affected by CVE-2024-0678?
All versions of the Order Delivery Date for WP e-Commerce plugin up to and including version 1.2 are affected by CVE-2024-0678.
Can unverified users exploit CVE-2024-0678?
Yes, CVE-2024-0678 can be exploited by unauthenticated attackers due to inadequate input sanitization and output escaping.
What is Cross-Site Scripting in the context of CVE-2024-0678?
In the context of CVE-2024-0678, Cross-Site Scripting refers to the ability of an attacker to inject malicious scripts via the 'available-days-tf' parameter into the web application.