CVE-2024-6288

Summary

CVE-2024-6288: The Conversios plugin for WooCommerce on WordPress, used for integrating Google Analytics 4, Meta Pixel, and more via Google Tag Manager, contains a Reflected Cross-Site Scripting (XSS) vulnerability. This issue arises due to insufficient input sanitization and output escaping on the ‘tiktok_user_id’ parameter. Unauthenticated attackers can exploit this flaw by injecting arbitrary web scripts, potentially stealing user data or taking control of user sessions, if they can persuade a user to click on a specially crafted link. Versions up to and including 7.0.12 are affected.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.