CVE-2024-6133: 
WordPress vulnerability analysis and mitigation

The wp-cart-for-digital-products WordPress plugin (WP eStore) before version 8.5.6 contains a reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Bob Matyas and was publicly disclosed on July 19, 2024. This security issue affects the customer search functionality of the plugin (WPScan).

The vulnerability stems from improper input sanitization and escaping of a parameter in the customer search functionality before it is output back to the page. This creates a reflected Cross-Site Scripting condition that could be exploited against high-privilege users such as administrators. The vulnerability has been assigned a CVSS 3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow attackers to execute malicious JavaScript code in the context of high-privilege users' browsers, potentially leading to unauthorized actions, data theft, or account compromise when an administrator visits a specially crafted URL (WPScan).

Users are advised to update their wp-cart-for-digital-products WordPress plugin to version 8.5.6 or later, which contains the fix for this vulnerability (WPScan).