CVE-2024-6072 — WP eStore < 8.5.5 - Reflected XSS via $_SERVER['REQUEST_URI']
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead …
Published: 2024-07-15 · CVSS: 6.1 · CVSS 3.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7