{"id":"CVE-2024-13461","title":"The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 du…","summary":"The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 du…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"patternsinthecloud","product":"autoship_cloud_for_woocommerce","affected":["autoship_cloud_for_woocommerce < 2.8.1"],"patched":["autoship_cloud_for_woocommerce 2.8.1"],"published":"2025-02-21","updated":"2026-08-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-13461","references":[{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242136%40autoship-cloud&new=3242136%40autoship-cloud&sfp_email=&sfph_mail=","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae16c4e-0151-4414-8612-ec8eb92505fd?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"epss":0.00246,"epssPercentile":0.16183,"ingestedAt":"2026-08-05T20:51:26.883Z","slug":"CVE-2024-13461","body":"## Overview\n\nThe Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\n## Affected\n\n- `autoship_cloud_for_woocommerce < 2.8.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `autoship_cloud_for_woocommerce 2.8.1`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}