Login Request a demo
Medium severity · published May 2, 2024
CVE-2024-3734
FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS
1%
EPSS
No
On KEV
Description
The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
FOX – Currency Switcher Professional for WooCommerce · realmag777
through 1.4.1.8 · source: vendor
FC
Fox - Currency Switcher Professional For Woocommerce · Pluginus
through 1.4.1.8 · source: CISA
Affected product
FC
FOX – Currency Switcher Professional for WooCommerce
realmag777
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3734
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/woocs.php#L4154
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072307%40woocommerce-currency-switcher%2Ftrunk&old=3049249%40woocommerce-currency-switcher%2Ftrunk&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1d49d0-c9aa-401c-80b9-d4df7fe97691?source=cve
More from FOX – Currency Switcher Professional for WooCommerce
8.8
CVE-2023-49834
WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)
8.1
CVE-2026-4094
FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion
7.3
CVE-2024-10640
The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVE-2024-8271
FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution
5.4
CVE-2023-6556
FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting