CVE-2024-35730: 
NixOS vulnerability analysis and mitigation

CVE-2024-35730 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Active Products Tables for WooCommerce plugin through version 1.0.6.3. The vulnerability was discovered by Le Ngoc Anh and publicly disclosed on June 6, 2024 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.1 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a higher CVSS score of 7.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could potentially lead to compromised user sessions, data theft, or malicious redirects (WPScan).

The vulnerability can be exploited by unauthenticated attackers and requires user interaction. No authentication is required to exploit this vulnerability, making it particularly concerning for websites using the affected plugin versions (Patchstack).

The vulnerability has been fixed in version 1.0.6.4 of the Active Products Tables for WooCommerce plugin. Users are strongly advised to update to this version or later to resolve the security issue. Patchstack has also issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).