HIGH
WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability
Published Aug 1, 2024
7.1
HIGHCVSS 3.1
EPSS 0.31%
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
Affected products
-
- Version -StatusaffectedConstraints<4.9.5
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| WPWeb Elite | WooCommerce PDF Vouchers | unaffected |
|
- < 4.9.5
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update to 4.9.5 or a higher version.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38157 Advisory
- https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38157 | Advisory | |
| https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | vdb-entryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Patchstack
Published Aug 1, 2024
Updated Apr 28, 2026
Reserved Jun 26, 2024
Link CVE-2024-39652
CISA Vulnrichment
Updated Aug 2, 2024
ENISA EUVD
EUVD-2024-38157 Assigner Patchstack
Published Aug 1, 2024
Updated Apr 28, 2026
Exploited since n/a
Link EUVD-2024-38157