CVE-2024-10675: WordPress Affiliate-Toolkit XSS Vulnerability

CVE-2024-10675 Overview

The affiliate-toolkit plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 3.6.7. The flaw stems from insufficient input sanitization and output escaping on a URL parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. Successful exploitation requires user interaction but no authentication, expanding the potential attack surface to any site visitor or administrator.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the affected WordPress site, enabling session theft, administrative action abuse, and malicious redirects.

Affected Products

WordPress affiliate-toolkit plugin versions <= 3.6.7
WordPress affiliate-toolkit-starter (shared codebase per plugin changeset)
WordPress sites running the plugin with any theme configuration

Discovery Timeline

2024-11-21 - CVE-2024-10675 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10675

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the affiliate-toolkit plugin. The plugin accepts a URL-supplied value and reflects it into the rendered page without applying WordPress sanitization functions such as esc_url(), esc_attr(), or esc_html(). An attacker crafts a URL containing JavaScript payloads in a vulnerable parameter and delivers it to a target through phishing, forum posts, or malicious advertisements.

When the victim loads the link, the payload executes in the origin of the affected WordPress site. The scope is changed (S:C in the CVSS vector), meaning the impact can cross security boundaries such as reaching other browser contexts. If the victim holds an authenticated administrator session, the attacker can perform privileged actions including plugin installation, user creation, or content modification through the WordPress REST API.

Root Cause

The plugin fails to sanitize input received through a URL parameter and does not escape the value before rendering it into HTML output. This missing input validation and output encoding matches the pattern classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an attacker to craft a URL containing an XSS payload targeting the vulnerable parameter, then trick a user into visiting it. Because no authentication is required, any visitor is a valid target. The payload executes in the browser context of the affected WordPress site.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the vendor-supplied fix details.

Detection Methods for CVE-2024-10675

Indicators of Compromise

Web server access logs containing requests to affiliate-toolkit plugin endpoints with URL parameters containing <script>, javascript:, onerror=, or encoded variants such as %3Cscript%3E.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking inbound links.
WordPress audit logs showing unexplained administrative actions correlated with reflected URL access.

Detection Strategies

Inspect WordPress access logs for query strings targeting affiliate-toolkit endpoints containing HTML tags or JavaScript event handlers.
Deploy Web Application Firewall (WAF) rules that block reflected XSS payload patterns in query parameters.
Compare installed plugin version against 3.6.7 using WP-CLI: wp plugin get affiliate-toolkit --field=version.

Monitoring Recommendations

Alert on referrer patterns showing users arriving at plugin URLs from external, low-reputation domains.
Monitor administrator sessions for anomalous REST API calls following browser navigation events.
Track Content Security Policy (CSP) violation reports for inline script execution on pages served by the plugin.

How to Mitigate CVE-2024-10675

Immediate Actions Required

Update the affiliate-toolkit plugin to a version later than 3.6.7 as published by the vendor.
If a fixed version is unavailable, deactivate and remove the plugin until a patch is applied.
Force logout of all administrator sessions and rotate credentials for privileged accounts that may have clicked untrusted links.

Patch Information

The vendor addressed the issue in a plugin update referenced by WordPress Plugin Changeset 3192067. Administrators should apply the update through the WordPress plugin manager or via WP-CLI: wp plugin update affiliate-toolkit.

Workarounds

Deploy a WAF rule blocking requests to affiliate-toolkit endpoints that contain script tags, event handlers, or javascript: URIs in query parameters.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources site-wide.
Restrict administrator panel access by IP allowlist to reduce the value of a stolen administrator session.

bash

# Example WP-CLI patch workflow
wp plugin get affiliate-toolkit --field=version
wp plugin update affiliate-toolkit
wp plugin get affiliate-toolkit --field=version