CVE-2024-1743: 
WordPress vulnerability analysis and mitigation

The WooCommerce Customers Manager WordPress plugin versions before 29.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and reported by Erwan LR from WPScan, with the CVE identifier CVE-2024-1743 being assigned on February 22, 2024 (CVE Mitre, WPScan).

The vulnerability stems from improper sanitization and escaping of various parameters before they are output back in pages and attributes. This security flaw has been assigned a CVSS score of 7.1 (High) and is classified under CWE-79. The vulnerability was publicly disclosed on April 3, 2024, and specifically affects high-privilege users such as administrators (WPScan).

The vulnerability allows for Reflected Cross-Site Scripting attacks specifically targeting high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed with administrative privileges if successfully exploited (WPScan).

A proof of concept exists demonstrating the vulnerability can be exploited by making a logged-in admin open a specifically crafted URL in the format: https://example.com/wp-admin/admin.php?page=woocommerce-customers-manager&action=wccm-customer-metadata&customer=">alert(/XSS/) (WPScan).

The vulnerability has been fixed in version 29.8 of the WooCommerce Customers Manager plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).