CVE-2024-11276: PDF Builder for WooCommerce XSS Vulnerability

CVE-2024-11276 Overview

CVE-2024-11276 is a Reflected Cross-Site Scripting (XSS) vulnerability in the PDF Builder for WooCommerce WordPress plugin. The plugin, which generates invoices and packing slips for WooCommerce stores, fails to sanitize input passed through the page parameter. All versions up to and including 1.2.136 are affected. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser session when the victim clicks a crafted link. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the browser of any user who clicks a crafted URL, enabling session theft, administrative action abuse, and phishing against WooCommerce store administrators.

Affected Products

PDF Builder for WooCommerce plugin for WordPress, versions up to and including 1.2.136
WooCommerce stores that install and activate the vulnerable plugin
WordPress administrators and users interacting with the plugin's admin pages

Discovery Timeline

2024-12-06 - CVE-2024-11276 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11276

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the PDF Builder for WooCommerce plugin. The plugin reads the page request parameter and echoes its value back into the rendered HTML response without proper sanitization or output escaping. When a victim loads a URL containing attacker-supplied script content in the page parameter, the browser executes that script in the origin of the WordPress site.

Reflected XSS in a WordPress admin context is particularly useful to attackers. If an authenticated administrator is tricked into clicking a malicious link, the injected script inherits the administrator's privileges. That allows the attacker to create new admin accounts, modify plugin settings, or exfiltrate session cookies and nonces.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on the page GET parameter. Secure WordPress development requires calling sanitize_text_field() on incoming input and esc_html(), esc_attr(), or esc_url() on data written to HTML output. The vulnerable plugin performs neither on this parameter, allowing raw HTML and script tags to reach the response body.

Attack Vector

Exploitation requires no authentication but does require user interaction. An attacker crafts a URL to the vulnerable WordPress site that includes JavaScript payload data in the page query string. The attacker delivers the URL through phishing, chat, or a malicious page. When the victim clicks the link, the payload reflects into the response and executes under the site's origin. See the Wordfence Vulnerability Report for the vulnerability record and the WordPress Plugin Change Log for the code changes that resolved the issue.

Detection Methods for CVE-2024-11276

Indicators of Compromise

Web server access logs containing requests to WordPress admin URLs where the page parameter includes HTML entities, <script> tags, javascript: URIs, or event handler strings such as onerror= and onload=.
Referrer headers pointing to unfamiliar external domains preceding requests that carry suspicious page parameter values.
Unexpected creation of WordPress administrator accounts or changes to plugin settings shortly after an administrator clicked an external link.

Detection Strategies

Inspect HTTP query strings for encoded and unencoded XSS payloads targeting the page parameter on the plugin's admin routes.
Correlate outbound requests from browsers of authenticated WordPress administrators against beaconing or credential-exfiltration destinations.
Deploy a Web Application Firewall (WAF) ruleset that flags reflected-XSS signatures on WordPress admin endpoints.

Monitoring Recommendations

Enable verbose access logging on WordPress and forward the logs to a centralized analytics platform for query-string inspection.
Alert on any WordPress plugin or theme file modification following an administrator session that included suspicious query parameters.
Monitor for new user creation, role changes, and option updates in the wp_options and wp_users tables.

How to Mitigate CVE-2024-11276

Immediate Actions Required

Update the PDF Builder for WooCommerce plugin to a version later than 1.2.136 as soon as the vendor releases a fixed build.
Audit administrator accounts and revoke any that were created unexpectedly during the exposure window.
Rotate WordPress administrator passwords and invalidate active sessions to remove any hijacked cookies.

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Plugin Change Log for the specific commit that adds sanitization and output escaping to the page parameter, and consult the Wordfence Vulnerability Report to confirm the fixed version before deploying.

Workarounds

Deactivate the PDF Builder for WooCommerce plugin until the fixed version is installed if patching cannot be completed immediately.
Configure a WAF rule to block requests to WordPress admin endpoints where the page parameter contains <, >, script, or javascript: substrings.
Restrict access to /wp-admin/ by IP allow-list so that only trusted operator networks can reach the vulnerable route.

bash

# Configuration example: block reflected XSS payloads in the `page` parameter at the web server tier
# nginx snippet
if ($args ~* "page=[^&]*(<|%3C|script|javascript:|onerror=|onload=)") {
    return 403;
}