CVE-2024-11418: Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting
The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shippingmethodfilter' parameter in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11418?
CVE-2024-11418 is classified as a medium-severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-11418?
To fix CVE-2024-11418, update the Additional Order Filters for WooCommerce plugin to version 1.22 or higher.
What is the impact of CVE-2024-11418?
The impact of CVE-2024-11418 includes the potential for an attacker to execute arbitrary JavaScript code in the context of the user's browser.
Which versions are affected by CVE-2024-11418?
All versions of the Additional Order Filters for WooCommerce plugin up to and including version 1.21 are affected by CVE-2024-11418.
Who should be concerned about CVE-2024-11418?
Website administrators using the Additional Order Filters for WooCommerce plugin should be concerned about CVE-2024-11418 and should implement the necessary updates.