CVE-2024-10049: 
WordPress vulnerability analysis and mitigation

The Edit WooCommerce Templates plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-10049) affecting all versions up to and including 1.1.2. The vulnerability was discovered and disclosed on October 17, 2024, and is tracked with a CVSS v3.1 score of 6.1 (Medium) (NVD, Wordfence).

The vulnerability exists due to insufficient input sanitization and output escaping in the 'page' parameter. This security flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has received a CVSS v3.1 Base Score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing specific actions, such as clicking on a malicious link. This can lead to the compromise of user sessions and potential unauthorized actions performed on behalf of the victim (NVD).

The vulnerability can be exploited by unauthenticated attackers who can craft malicious links containing XSS payloads. The attack requires user interaction, as victims must be tricked into clicking on a specially crafted link for the exploit to succeed (NVD).

Users of the Edit WooCommerce Templates plugin should upgrade to a version newer than 1.1.2 as soon as possible to address this vulnerability (NVD).