CVE-2024-11365: Hedge3 Crypto Widgets XSS Vulnerability

CVE-2024-11365 Overview

CVE-2024-11365 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress. The flaw affects all versions up to and including 1.1.6 and stems from unsafe use of add_query_arg without proper URL escaping. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The vulnerability was published to the National Vulnerability Database on November 21, 2024.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session by tricking them into clicking a malicious link, enabling session hijacking, account takeover, or backend content manipulation.

Affected Products

Hedge3 Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress
All plugin versions up to and including 1.1.6
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-11-21 - CVE-2024-11365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11365

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw caused by the plugin's use of the WordPress add_query_arg function without escaping the resulting URL before outputting it to the page. When user-controlled input is appended to a URL and reflected back in the DOM, an attacker can craft a request containing JavaScript payloads that execute in the victim's browser context.

Reflected XSS requires user interaction. The attacker must convince a target, typically an authenticated WordPress administrator, to click a specially crafted link. Once the payload executes, it runs with the privileges of the victim's active session on the WordPress site.

The scope change indicated by the CVSS vector means the injected script can affect resources beyond the vulnerable component, including the WordPress admin dashboard. Successful exploitation can lead to session theft, forced administrative actions, plugin backdooring, or persistent compromise through follow-on injection.

Root Cause

The plugin passes attacker-controlled query parameters into add_query_arg and echoes the return value into HTML without applying esc_url, esc_attr, or similar output-encoding routines. The historical WordPress guidance requires escaping the output of add_query_arg because it preserves whatever the caller provides, including reflected parameters. References to the WordPress Settings API code paths at class.settings-api.php line 2460 and line 2497 illustrate the pattern that leads to this class of bug.

Attack Vector

Exploitation is remote and requires no authentication, but does require user interaction. An attacker crafts a URL containing a malicious payload in a query parameter that the plugin reflects into a page. The attacker then delivers this URL through phishing email, social media, forum posts, or malicious advertising. When a logged-in WordPress user, particularly an administrator, visits the URL, the payload executes with their session privileges. See the Wordfence Vulnerability Report for additional context.

No verified public proof-of-concept code is available. The vulnerability class is well-documented in WordPress plugin security advisories, and exploitation follows the standard reflected XSS pattern of appending an encoded <script> payload or event handler to a vulnerable query parameter.

Detection Methods for CVE-2024-11365

Indicators of Compromise

Web server access logs containing query strings with URL-encoded <script>, javascript:, or common XSS payload fragments targeting plugin endpoints
Referrer headers from external sites pointing to WordPress admin URLs containing suspicious query parameters
Unexpected administrator account creation, password resets, or plugin installations following administrator link clicks
Outbound requests from browsers to attacker-controlled domains originating from WordPress admin sessions

Detection Strategies

Inventory WordPress plugin versions across all sites and flag any installation of Crypto and DeFi Widgets at version 1.1.6 or earlier
Deploy Web Application Firewall (WAF) rules that inspect query parameters for XSS payload patterns before they reach WordPress
Monitor for reflected script content in HTTP responses using DAST scanners or content inspection proxies
Correlate administrator authentication events with subsequent anomalous admin actions initiated from unusual referrers

Monitoring Recommendations

Enable WordPress audit logging to capture administrator activity, plugin changes, and user role modifications
Forward web server and WordPress logs to a centralized SIEM for pattern analysis and long-term retention
Alert on HTTP 200 responses containing reflected query parameter values inside <script> tags or event handler attributes
Track browser Content Security Policy (CSP) violation reports if CSP is enforced on the WordPress site

How to Mitigate CVE-2024-11365

Immediate Actions Required

Update the Crypto and DeFi Widgets plugin to a version newer than 1.1.6 as soon as a patched release is available from the vendor
If no patched version exists, deactivate and remove the plugin from all affected WordPress installations
Rotate WordPress administrator credentials and invalidate active sessions if any admin has clicked suspicious links referencing the plugin
Review WordPress user accounts and installed plugins for unauthorized additions or modifications

Patch Information

No vendor advisory URLs are listed in the CVE record at the time of publication. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for a fixed release. Until a patch is confirmed, treat all versions up to and including 1.1.6 as vulnerable.

Workarounds

Remove or deactivate the Crypto and DeFi Widgets plugin until a patched version is released
Deploy a WAF with reflected XSS signatures in front of the WordPress site to block common payload patterns in query strings
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict WordPress administrator access to trusted networks and require multi-factor authentication for all privileged accounts

bash

# Example WordPress CLI commands to inventory and deactivate the vulnerable plugin
wp plugin list --name=crypto-and-defi-widgets --fields=name,status,version
wp plugin deactivate crypto-and-defi-widgets
wp plugin delete crypto-and-defi-widgets