CVE-2024-10683: WordPress PayPal & Stripe Add-on XSS Flaw

CVE-2024-10683 Overview

CVE-2024-10683 is a reflected Cross-Site Scripting (XSS) vulnerability in the Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress. The flaw affects all versions up to and including 2.3.1. It stems from the unsafe use of add_query_arg and remove_query_arg without proper output escaping on the returned URL. Unauthenticated attackers can inject arbitrary JavaScript that executes in an administrator's browser when the victim clicks a crafted link. Exploitation is only possible when the "leave a review" notice is currently displayed in the WordPress dashboard, which narrows the window of exposure. The issue is tracked under CWE-79.

Critical Impact
A successful attack lets an unauthenticated actor execute arbitrary JavaScript in the context of a logged-in WordPress administrator, enabling session hijacking, admin actions, and site takeover pivots.

Affected Products

WPPlugin Contact Form 7 – PayPal & Stripe Add-on for WordPress (all versions ≤ 2.3.1)
WordPress sites where the plugin's admin "leave a review" notice is active
Administrator dashboard sessions that render the vulnerable notice URL

Discovery Timeline

2024-11-09 - CVE-2024-10683 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10683

Vulnerability Analysis

The plugin renders an administrative "leave a review" notice that generates dismissal links using the WordPress helpers add_query_arg and remove_query_arg. Both helpers return the current request URI when no explicit URL argument is passed, and neither performs contextual escaping for HTML output. The plugin echoes the returned value directly into anchor tags in includes/admin/notices.php at lines 46 and 48. An attacker who crafts a URL containing script-bearing query parameters can therefore force reflected content into the admin page. When a logged-in administrator clicks the link, the injected script executes with the privileges of the admin session. Because the notice is rendered inside the WordPress admin, arbitrary JavaScript can invoke administrative REST endpoints, create new users, or install malicious plugins.

Root Cause

The root cause is missing output escaping on data returned by add_query_arg and remove_query_arg. WordPress documentation explicitly warns that the return value of these helpers is not sanitized and must be passed through esc_url before being rendered in HTML. The plugin omitted that escaping step, producing a classic reflected XSS ([CWE-79]) sink.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to the vulnerable WordPress admin page that appends attacker-controlled query parameters, then delivers the link to an administrator through phishing, forum posts, or malicious referrers. When the administrator clicks the link while the review notice is displayed, the payload is reflected into the DOM and executed. No authentication is required from the attacker, but the victim must be an authenticated administrator viewing a dashboard that renders the review notice.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Analysis and the referenced source lines at notices.php#L46 and notices.php#L48 for technical details.

Detection Methods for CVE-2024-10683

Indicators of Compromise

Requests to /wp-admin/ URLs containing suspicious query parameters with HTML entities, <script>, javascript:, or event handler strings such as onerror= and onmouseover=.
Referrer headers pointing to untrusted external sites immediately preceding new WordPress administrator user creation or plugin installation events.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking emailed or chat-delivered links.

Detection Strategies

Inspect WordPress access logs for admin-area URLs containing encoded angle brackets (%3C, %3E) or reflected script fragments in the query string.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns in query parameters targeting /wp-admin/ endpoints for sites running the affected plugin.
Correlate administrator click events with subsequent privileged actions such as user creation, role changes, or plugin uploads within a short time window.

Monitoring Recommendations

Track installed plugin versions across the WordPress estate and alert on any host still running Contact Form 7 – PayPal & Stripe Add-on ≤ 2.3.1.
Monitor administrator session activity for anomalous REST API calls (/wp-json/wp/v2/users, /wp-json/wp/v2/plugins) originating from a browser session that just followed an external referrer.
Enable file integrity monitoring on the wp-content/plugins/ and wp-content/mu-plugins/ directories to catch post-XSS persistence attempts.

How to Mitigate CVE-2024-10683

Immediate Actions Required

Update the Contact Form 7 – PayPal & Stripe Add-on plugin to a version above 2.3.1 that incorporates the fix from WordPress Changeset #3182753.
Instruct administrators to dismiss the "leave a review" notice, which removes the vulnerable rendering path until patching is complete.
Review recent administrator activity logs for anomalous user creation, role changes, or plugin installations that could indicate prior exploitation.

Patch Information

The vendor released a fix in WordPress Plugin Changeset #3182753 that escapes the URL returned by add_query_arg and remove_query_arg using esc_url before rendering the review notice. Site operators should apply the update through the WordPress plugin manager or WP-CLI. Confirm the installed version is greater than 2.3.1 across every WordPress instance in the environment.

Workarounds

Temporarily deactivate the Contact Form 7 – PayPal & Stripe Add-on plugin until the patched version is installed.
Restrict WordPress admin access with IP allowlists or a reverse-proxy WAF to reduce the phishing surface for administrators.
Enforce a strict Content Security Policy (CSP) in the admin area to block inline script execution from reflected payloads.

bash

# Update the plugin via WP-CLI to remediate CVE-2024-10683
wp plugin update contact-form-7-paypal-add-on
wp plugin get contact-form-7-paypal-add-on --field=version

# If a patched version is not yet available, deactivate the plugin
wp plugin deactivate contact-form-7-paypal-add-on