CVE-2025-24609

CVE-2025-24609 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the PORTONE 우커머스 결제 iamport-for-woocommerce WordPress plugin. This issue impacts all versions of the plugin up to and including 3.2.4. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction requirement, and changed scope with low impacts on confidentiality, integrity, and availability.

Attackers can exploit this Reflected XSS vulnerability remotely without authentication by tricking authenticated users, such as site administrators or logged-in visitors, into interacting with maliciously crafted links or inputs that reflect executable scripts back in the web page response. Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, theft of sensitive data like cookies or tokens, or further phishing attacks, though impacts are limited to low levels across confidentiality, integrity, and availability due to the changed scope.

Patchstack advisories document this vulnerability in detail for the iamport-for-woocommerce plugin version 3.2.4 and earlier, providing vulnerability intelligence for WordPress environments. Security practitioners should update to a patched version beyond 3.2.4 if available, or apply input sanitization workarounds, while monitoring for plugin updates from the vendor.