CVE-2024-56023

CVE-2024-56023 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, in the PerfectSolution WP eCommerce Quickpay WordPress plugin (wp-ecommerce-quickpay). This issue affects all versions of the plugin up to and including 1.1.0. The vulnerability has a CVSS v3.1 base score of 7.1, rated High severity, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Attackers can exploit this reflected XSS vulnerability remotely over the network with low complexity and no required privileges, though it requires user interaction such as clicking a malicious link. Successful exploitation allows execution of arbitrary scripts in the victim's browser context, potentially leading to low-impact confidentiality, integrity, and availability effects with a changed scope, such as session hijacking, data theft, or phishing within the affected WordPress site.

Patchstack advisories detail the vulnerability and recommend updating to a patched version beyond 1.1.0 or disabling the plugin, as referenced at https://patchstack.com/database/Wordpress/Plugin/wp-ecommerce-quickpay/vulnerability/wordpress-wp-ecommerce-quickpay-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.