CVE Database /
CVE-2024-4039
CVE · Medium
CVE-2024-4039 — Trakoo – Orders Tracking for WooCommerce [woo-orders-tracking] < 1.2.11
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4039
|
Trakoo – Orders Tracking for WooCommerce [woo-orders-tracking] < 1.2.11 |
Improper Control of Generation of Code ('Code Injection') |
Medium
6.5
|
< 1.2.11
|
1.2.11 |
2024-05-09 |
—
|
CVE-2024-4039
The Orders Tracking for WooCommerce plugin through version 1.2.10 contains a vulnerability allowing unauthenticated users to execute arbitrary shortcodes. An action in the plugin fails to properly sanitize input before passing it to do_shortcode, which allows attackers to run malicious shortcodes. Version 1.2.10 provided a partial fix, while version 1.2.11 fully resolves the issue.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings