CVE-2024-0251

The Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, and including, 2.96 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects sites when the Dynamic Content for Elementor plugin is also installed.

We have discovered 1,021 live websites that are affected by CVE-2024-0251.

Affected Software


Product	Advanced Woo Search
Category	Wordpress Plugins
Vulnerable Versions	from 0 through 2.96
Total Vulnerable Versions	169
Vulnerable Domains	1,021 live websites (32.44% of Advanced Woo Search install base)

Available Reports

Website List

Details

Published - Jan 13, 2024
Updated - Jan 13, 2024

Credits

Artem Guzhva (finder)

CVE References

CWE References

cwe.mitre.org

Countries

United States	242 websites

Germany	79 websites
GB	74 websites
Russia	60 websites
Italy	51 websites
France	48 websites
Spain	45 websites
Australia	39 websites
Netherlands	39 websites
Poland	30 websites

TLDs

.com	407 websites
.ru	52 websites
.de	46 websites
.co.uk	41 websites
.com.au	37 websites
.org	32 websites
.it	32 websites
.pl	27 websites
.nl	27 websites
.net	21 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

References

Websites affected by CVE-2024-0251

Top websites that are affected by CVE-2024-0251. Please click on the "Contact us" link to get more information.

Domain	Country	Rank
*.********.com	United States	,**
****************.com	United States	,*
***********.hu	Hungary	,*
*.*****************.com	United States	,*
*.************.com	Spain	*,*
*.************.com	United States	*,*
*************.com	Australia	*,*
*****..*.ni	Nicaragua	*,*
***********.shop	Spain	*,*
************.ir	Iran	*,*

See full domain list