CVE-2024-11805: 
WordPress vulnerability analysis and mitigation

The Quick License Manager – WooCommerce Plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-11805) in versions up to and including 2.4.17. The vulnerability was discovered and reported by Wordfence, with disclosure occurring on December 3, 2024 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping of the 'submit_qlm_products' parameter. This security flaw has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring user interaction (Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact is limited to client-side attacks that could potentially compromise user data or session information (NVD).

The vulnerability can be exploited by an unauthenticated attacker who must convince a user to perform a specific action, such as clicking on a specially crafted link. The attack requires no privileges but does need user interaction to succeed (Wordfence).

Users should update to a version newer than 2.4.17 of the Quick License Manager – WooCommerce Plugin when available. The vulnerability has been addressed in the WordPress plugin repository (WordPress Plugin).