PT-2024-20569 · Unknown · Adtribes.Io Product Feed Pro For Woocommerce

Rafie Muhammad · Published 2024-03-26 · Updated 2024-03-27 · CVE-2024-24800

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AdTribes.Io Product Feed PRO for WooCommerce versions through 13.2.5

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS.

Recommendations For versions through 13.2.5, update to a version later than 13.2.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive username and password variables in the affected API endpoints until a patch is available. Avoid using the vulnerable Product Feed PRO for WooCommerce module in the affected versions until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24800

Affected Products

Adtribes.Io Product Feed Pro For Woocommerce

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-24800 · Security Note
• https://twitter.com/CVEnew/status/1772864277613056190 · Twitter Post
• https://t.me/cvenotify/74797 · Telegram Post
• https://patchstack.com/database/vulnerability/woo-product-feed-pro/wordpress-product-feed-pro-for-woocommerce-plugin-13-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note