CVE-2024-29760: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in Pluggabl LLC's Booster for WooCommerce WordPress plugin, affecting versions up to and including 7.1.7. The vulnerability was disclosed on March 25, 2024, and was assigned CVE-2024-29760 (Patchstack, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's code. It has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N by NIST NVD, while Patchstack assessed it with a higher CVSS score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. The successful exploitation could lead to the injection of malicious scripts, unauthorized redirects, unwanted advertisements, and other malicious HTML payloads that execute when visitors access the affected website (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, requiring user interaction such as clicking on a specially crafted link. The attack complexity is considered low, making it relatively straightforward for attackers to exploit (WPScan).

The vulnerability has been patched in version 7.1.8 of the Booster for WooCommerce plugin. Users are strongly advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).