CVE-2024-12049: 
WordPress vulnerability analysis and mitigation

The Woo Ukrposhta plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-12049) affecting versions up to and including 1.17.11. The vulnerability exists due to insufficient input sanitization and output escaping in the 'order', 'post', and 'idd' parameters (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.1 (Medium). The attack vector requires no authentication (PR:N) but does need user interaction (UI:R) to execute. The vulnerability allows attackers to inject arbitrary web scripts that execute when users perform specific actions like clicking on malicious links (Wordfence).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary web scripts in the context of targeted users' browsers. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

Users should update to a version newer than 1.17.11 of the Woo Ukrposhta plugin to address this vulnerability. The issue has been fixed in subsequent releases (WordPress Plugin).