WordPress Plugin Vulnerabilities

DPD Baltic Shipping < 1.2.84 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Proof of Concept

Affects Plugins

Plugin icon
woo-shipping-dpd-baltic
Fixed in 1.2.84

References

CVE
CVE-2024-9350
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6251d0f6-b536-4122-8fdf-bb77665a4f41

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
vgo0
Verified
Yes
WPVDB ID
55eecbc5-cab4-4942-a080-51240f9bf961

Timeline

Publicly Published
2024-10-17 (about 1 year ago)
Added
2024-10-17 (about 1 year ago)
Last Updated
2024-10-22 (about 1 year ago)

Other

Published
Title
Published
2024-11-08
Title
AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-10-16
Title
WP Discord Invite < 2.5.2 - Admin+ Stored Cross Site Scripting
Published
2024-06-20
Title
My Favorites < 1.4.4 - Contributor+ Stored XSS
Published
2025-03-19
Title
HT Mega – Absolute Addons For Elementor < 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2024-11-20
Title
RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting