CVE-2024-11809: 
WordPress vulnerability analysis and mitigation

The Primer MyData for Woocommerce plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-11809) affecting all versions up to and including 4.2.1. The vulnerability was disclosed on December 13, 2024, and is tracked with a CVSS v3.1 base score of 6.1 (Medium) (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping of the 'img_src' parameter. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD, Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact is rated as low for both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability requires user interaction to be exploited, such as tricking a user into clicking on a specially crafted link. The attack can be performed by an unauthenticated attacker from the network vector (NVD).

Users should update the Primer MyData for Woocommerce plugin to a version newer than 4.2.1 once available (NVD).