CVE-2024-13696
Published: 29 January 2025
Description
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Security Summary
CVE-2024-13696 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting the Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress. The issue impacts all versions up to and including 1.2.25 and arises from insufficient input sanitization and output escaping of the 'wishlist_name' parameter. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and was published on 2025-01-29.
Unauthenticated attackers can exploit the vulnerability over the network with low complexity and no user interaction required. By injecting arbitrary web scripts via the 'wishlist_name' parameter, attackers can store malicious payloads on wishlist pages, which execute in users' browsers whenever those pages are accessed, potentially compromising confidentiality and integrity.
Reference advisories, including a Wordfence threat intelligence report and WordPress plugin repository details, point to mitigation via changeset 3230370, which addresses the sanitization flaw. The plugin's developer page and front-end JavaScript source further document the affected code, recommending updates beyond version 1.2.25 for remediation.
Details
- CWE(s)