CVE-2024-9165: Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9165?
The severity of CVE-2024-9165 is classified as high due to the potential for stored cross-site scripting exploits.
How do I fix CVE-2024-9165?
To fix CVE-2024-9165, update the WooCommerce Gift Cards (Gift Vouchers and Packages) plugin to version 4.4.5 or later.
What versions of WooCommerce Gift Cards are affected by CVE-2024-9165?
All versions of the WooCommerce Gift Cards (Gift Vouchers and Packages) plugin up to and including 4.4.4 are affected by CVE-2024-9165.
Can CVE-2024-9165 be exploited through file uploads?
Yes, CVE-2024-9165 can be exploited through SVG file uploads due to insufficient input sanitization in the affected plugin.
What types of attacks are possible with CVE-2024-9165?
CVE-2024-9165 allows attackers to execute stored cross-site scripting (XSS) attacks, which can compromise user sessions and expose sensitive data.