CVE-2024-6288

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktok_user_id’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-62896.1The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, a CVE-2024-62908.8Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2024-62918.8Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via CVE-2024-62928.8Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2024-62938.8Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2024-62943.9udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access CVE-2024-62953.9udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an att CVE-2024-62966.4The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ param CVE-2024-629710.0Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat acto CVE-2024-62989.8Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Atta CVE-2024-62993.7Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forg CVE-2024-63005.3Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU befo