CVE-2024-56301

CVE-2024-56301 is an Improper Neutralization of Input During Web Page Generation vulnerability, specifically a Reflected Cross-Site Scripting (XSS) issue classified under CWE-79, affecting the WordPress plugin Distance Based Shipping Calculator developed by enituretechnology. The vulnerability impacts all versions of the plugin from an unspecified initial release through 2.0.21, where user input is not properly sanitized during web page generation, enabling the injection of malicious scripts.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but necessitating user interaction such as clicking a crafted link. Any unauthenticated remote attacker can deliver a malicious payload via reflected input, achieving low-level impacts on confidentiality, integrity, and availability with a changed scope, typically allowing script execution in the context of the targeted user's browser on the affected site.

Patchstack's advisory documents the vulnerability in the Distance Based Shipping Calculator plugin up to version 2.0.21, highlighting the Reflected XSS risk in detail.