CVE-2024-14015

HIGHNuclei

Studiocart <= 2.9.0 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-14015 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 24, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WordPress eCommerce Plugin

Default status: unknown

CVE ListThrough 2.9.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMStudiocart <= 2.9.0 - Cross-Site Scripting

The Studiocart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

Attackers can execute scripts in the context of high privilege users, potentially leading to session hijacking or privilege escalation.

Remediation

Update to the latest version beyond 2.9.0.

AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginstudiocartxssreflectedauthenticated
https://nvd.nist.gov/vuln/detail/CVE-2024-14015

Source: ProjectDiscovery

References

2