CVE-2024-4455

Deeper analysis

The YITH WooCommerce Ajax Search plugin for WordPress is affected by a stored cross-site scripting vulnerability in versions up to and including 2.4.0. The flaw resides in the handling of the ‘item’ parameter and stems from insufficient input sanitization and output escaping, allowing arbitrary scripts to be stored and later executed in the browser of users who access an injected page.

Unauthenticated attackers can exploit the issue remotely with no user interaction required. Successful exploitation permits injection of malicious web scripts that run in the context of the affected site, enabling actions such as data theft or unauthorized operations within the WordPress environment due to the changed scope.

References including Wordfence threat intelligence and WordPress plugin trac changesets indicate that the issue is resolved by applying the available patch, which updates the affected statistic list table code to enforce proper escaping.

The associated EPSS score rose from a low baseline to a peak of 0.1006 before receding to the current value of 0.0664, signaling that exploitation interest emerged after public disclosure.