CVE-2024-11225: WordPress Premium Packages Plugin XSS Flaw

CVE-2024-11225 Overview

CVE-2024-11225 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Premium Packages – Sell Digital Products Securely plugin for WordPress. The flaw affects all versions up to and including 5.9.3. The plugin uses add_query_arg without appropriate escaping on the URL, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Exploitation requires user interaction, such as clicking a crafted link. Successful attacks execute attacker-controlled scripts in the victim's browser session on the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser when the victim clicks a malicious link, enabling session theft, credential harvesting, and administrative action hijacking on affected WordPress sites.

Affected Products

WordPress Premium Packages – Sell Digital Products Securely plugin (wpdm-premium-packages) versions ≤ 5.9.3
Vulnerable code paths in includes/libs/functions.php at lines 420, 422, and 584
WordPress installations exposing the plugin's URL parameters to unauthenticated users

Discovery Timeline

2024-11-22 - CVE-2024-11225 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11225

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw categorized under [CWE-79]. The Premium Packages plugin constructs URLs using WordPress's add_query_arg function without escaping the returned URL before echoing it back into HTML output. When a user visits a request containing crafted query parameters, the plugin reflects unsanitized input into the page. The browser interprets the reflected payload as executable script in the origin of the vulnerable WordPress site. Because the injection occurs before authentication checks, any visitor tricked into clicking a crafted link can trigger the payload. The attacker's script runs with the privileges of the victim's browser session, including any active WordPress cookies.

Root Cause

The root cause is missing output encoding on the return value of add_query_arg. WordPress developer documentation has long warned that add_query_arg and remove_query_arg return unescaped strings derived from $_SERVER['REQUEST_URI']. Plugin code at includes/libs/functions.php lines 420, 422, and 584 concatenates this return value into HTML attribute or link contexts without applying esc_url, esc_attr, or esc_html. The fix committed in changeset 3195568 wraps the affected outputs with appropriate escaping routines.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL that appends malicious query parameters to a page rendered by the vulnerable plugin. The attacker delivers the link through phishing email, social media, forum posts, or malicious advertisements. When a victim clicks the link, the plugin reflects the payload into the response. The injected JavaScript executes in the WordPress site's origin, granting the attacker access to session cookies, the DOM, and any authenticated actions the victim can perform. If the victim is an administrator, the attacker can pivot to actions such as creating accounts or modifying content.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin ChangeSet for technical remediation details.

Detection Methods for CVE-2024-11225

Indicators of Compromise

Web server access logs containing plugin URLs with query parameters that include HTML entities, <script> tags, javascript: URIs, or event handlers such as onerror= and onload=
Referrer headers originating from external phishing domains linking directly to plugin-rendered pages
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after link clicks
Newly created administrator accounts or modified plugin settings following suspicious link activity

Detection Strategies

Inspect HTTP request logs for query string values containing script tags, encoded angle brackets (%3C, %3E), or JavaScript URI schemes targeting the wpdm-premium-packages plugin paths
Deploy a Web Application Firewall (WAF) rule set that blocks reflected XSS payloads on WordPress endpoints
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions and unexpected script sources
Correlate user-agent, referrer, and query string anomalies against known phishing infrastructure

Monitoring Recommendations

Monitor for administrator sessions performing unusual actions immediately after external link navigation
Alert on plugin version disclosure in HTTP responses to identify unpatched installations
Track CSP violation reports and browser console errors reported by users on WordPress front-end pages

How to Mitigate CVE-2024-11225

Immediate Actions Required

Update the Premium Packages – Sell Digital Products Securely plugin to a version later than 5.9.3 that includes changeset 3195568
Audit WordPress administrator and editor accounts for unauthorized changes made after November 2024
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources on the WordPress site
Rotate WordPress session cookies and administrator credentials if suspicious clicks or reflected payloads are observed

Patch Information

The vendor addressed the vulnerability in the plugin release following version 5.9.3. The fix is documented in the WordPress Plugin ChangeSet 3195568. Administrators should update through the WordPress plugin manager or download the current release from the WordPress Plugin Developer Page.

Workarounds

Deactivate the Premium Packages plugin until the patched version is deployed
Deploy a WAF rule blocking requests to plugin endpoints that contain <, >, or javascript: in query parameters
Restrict access to WordPress administrative interfaces by IP allowlist to reduce the blast radius of a successful XSS against privileged users
Educate users and administrators to avoid clicking untrusted links referencing the WordPress site

bash

# Example WAF rule (ModSecurity) blocking reflected XSS patterns on plugin paths
SecRule REQUEST_URI "@contains /wpdm-premium-packages/" \
  "chain,phase:2,deny,status:403,id:1002024,\
   msg:'CVE-2024-11225 Reflected XSS attempt'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "t:none,t:urlDecodeUni"