CVE-2024-0251
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2024-0251 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Advanced Woo Search plugin for WordPress. Versions up to and including 2.96 are vulnerable due to insufficient input sanitization and output escaping in the search parameter. An attacker can exploit this weakness by injecting arbitrary web scripts that can execute if a user clicks on a malicious link. This issue only poses a threat when the Dynamic Content for Elementor plugin is also installed on a WordPress site. Unauthenticated attackers can take advantage of this vulnerability to gain unauthorized access and potentially steal sensitive data from unsuspecting users. WordPress site administrators are strongly advised to update the Advanced Woo Search plugin to the latest version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Advanced Woo Search
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions