CVE-2024-11400: 
WordPress vulnerability analysis and mitigation

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-11400) that affects all versions up to and including 1.3.6.3. The vulnerability was discovered and reported by Wordfence, with the initial disclosure made on November 19, 2024 (Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping of the really_curr_tax parameter. This security flaw has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD Database).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when users perform specific actions, such as clicking on a malicious link. The impact primarily affects confidentiality and integrity with low severity, while availability remains unaffected (Wordfence Advisory).

A patch for this vulnerability has been released and is available through the WordPress plugin repository (WordPress Patch). Users are advised to update their HUSKY – Products Filter Professional for WooCommerce plugin to the latest version to mitigate this security risk.