CVE-2024-8541: 
WordPress vulnerability analysis and mitigation

The Discount Rules for WooCommerce plugin (versions up to 2.6.5) contains a Reflected Cross-Site Scripting vulnerability due to improper URL escaping. The vulnerability was discovered and disclosed on October 15, 2024, affecting the plugin's 'Leave a Review' notice functionality (NVD Database).

The vulnerability stems from improper use of add_query_arg without appropriate URL escaping in the plugin's review notice component. This vulnerability is specifically tied to the 'Leave a Review' notice that appears after 100 orders are made and remains until dismissed by a user. The severity is rated as MEDIUM with a CVSS v3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) according to NVD's assessment (NVD Database).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when site administrators click on specially crafted links. The impact is limited to scenarios where the 'Leave a Review' notice is active (NVD Database).

The vulnerability requires user interaction and is only exploitable when the 'Leave a Review' notice is present (which appears after 100 orders and disappears after dismissal). An attacker would need to trick a site administrator into clicking a malicious link to execute the attack (NVD Database).

The vulnerability has been patched in version 2.6.5 of the Discount Rules for WooCommerce plugin. Site administrators are advised to update to this version or later to mitigate the risk (NVD Database).