CVE-2024-0905: 
WordPress vulnerability analysis and mitigation

The Fancy Product Designer WordPress plugin before version 6.1.8 contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-0905). The vulnerability was discovered by Bob Matyas and publicly disclosed on April 5, 2024. The issue affects both unauthenticated and admin-level users of WordPress installations using this plugin (WPScan).

The vulnerability stems from improper parameter sanitization and escaping before output rendering in the page. The CVSS 3.1 base score is 6.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The vulnerability is classified under CWE-79 (Cross-Site Scripting) and is listed as A7 in the OWASP Top 10 (NVD, WPScan).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The impact affects both unauthenticated visitors and administrative users of the WordPress site (WPScan).

The vulnerability requires WooCommerce to be installed and can be exploited by manipulating the cart_item_key parameter in the product URL. A proof of concept has been publicly disclosed, demonstrating the exploitation process through the product page URL (WPScan).

The vulnerability has been fixed in version 6.1.8 of the Fancy Product Designer plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).