CVE-2024-54439 HIGH

CVE-2024-54439: WordPress Amazon Product Price plugin <= 1.1 - CSRF to Stored XSS vulnerability

Vendor Alok Tiwari
Product Amazon Product Price
Weakness CWE-352 · CSRF
Published December 16, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.

Explanation of Vulnerability in Simple Terms

02Summary

Amazon Product Price versions 1.1 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and can affect confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Trick a site admin into visiting a malicious page that performs unwanted actions on the site.

Potential impact on your site

04Site Impact

An attacker can modify settings, create accounts, or alter data by tricking admins into visiting malicious links.

Conditions required to exploit

05Prerequisites

Site admin must visit an attacker-controlled webpage while logged into the site.

Key dates

06Disclosure timeline

December 16, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-44630 WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF) CVE-2026-8910 WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter CVE-2026-8944 Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter CVE-2026-9618 PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink CVE-2026-7047 Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action