CVE-2024-7846

Description

YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.

Reserved 2024-08-15 | Published 2024-09-23 | Updated 2024-09-23 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 2.7.1
affected

Credits

John Castro finder

WPScan coordinator

References

wpscan.com/...rability/86f7a136-d09b-4637-97ae-2cdaaff172a3/ exploit vdb-entry technical-description

cve.org (CVE-2024-7846)

nvd.nist.gov (CVE-2024-7846)

Download JSON