CVE-2024-14015

HighCVSS 7.1/10Last modified Oct 2, 2026

Description

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected software

No affected versions have been published.

Timeline

Published
Nov 24, 2025
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-14024.3Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to beCVE-2024-140205.0A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the CVE-2024-140217.8LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_frCVE-2024-140246.7An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who haCVE-2024-140256.7An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an CVE-2024-140267.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network accCVE-2024-140275.5In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernCVE-2024-140286.5Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: tCVE-2024-140297.5Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunkCVE-2024-14039.8In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an CVE-2024-140308.1Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embedsCVE-2024-140318.1Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds