CVE-2024-11814: Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting
The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwpwcosdeletefinished, wfwpwcosdeletefallbackfinished, wfwpwcosdeletefallbackordersupdated, and wfwpwcosdeletefallbackstatus parameters in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11814?
CVE-2024-11814 has a moderate severity level due to its potential for reflected cross-site scripting.
How do I fix CVE-2024-11814?
To fix CVE-2024-11814, update the Additional Custom Order Status for WooCommerce plugin to version 1.6.1 or later.
Which versions of WooCommerce Additional Custom Order Status are affected by CVE-2024-11814?
CVE-2024-11814 affects all versions of the Additional Custom Order Status for WooCommerce plugin up to and including version 1.6.0.
What are the parameters involved in the CVE-2024-11814 vulnerability?
The parameters involved in CVE-2024-11814 are wfwp_wcos_delete_finished, wfwp_wcos_delete_fallback_finished, wfwp_wcos_delete_fallback_orders_updated, and wfwp_wcos_delete_fallback_status.
What type of attack does CVE-2024-11814 enable?
CVE-2024-11814 enables reflected cross-site scripting (XSS) attacks, allowing attackers to execute scripts in the context of a user's browser.