CVE-2024-11369 Overview
CVE-2024-11369 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Store Credit / Gift Cards for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.0.49.46. It stems from insufficient input sanitization and output escaping in the coupon, start_date, and end_date parameters within the admin report interface. Unauthenticated attackers can inject arbitrary JavaScript into pages, which executes when a targeted user clicks a crafted link. The issue is tracked under CWE-79.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browser of an authenticated administrator, enabling session theft, account takeover, or malicious admin actions.
Affected Products
- Store Credit / Gift Cards for WooCommerce plugin for WordPress
- All versions up to and including 1.0.49.46
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-01-07 - CVE-2024-11369 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11369
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting flaw in the plugin's admin report component. Three request parameters, coupon, start_date, and end_date, are echoed back into the rendered HTML without adequate sanitization or output escaping. An attacker crafts a URL containing malicious JavaScript in one of these parameters and lures an authenticated user, typically an administrator, into clicking it. The browser then executes the injected script under the origin of the WordPress site.
Because exploitation occurs in the context of an authenticated administrator session, attackers can steal session cookies, perform actions on behalf of the admin, create rogue users, or pivot to broader site compromise. The affected code paths are referenced in the plugin's admin/report.php file at lines 95, 113, and 119, and the fix landed in WordPress Changeset 3213698.
Root Cause
The root cause is missing input sanitization on incoming request parameters and missing output escaping when those parameters are rendered into the HTML response. Standard WordPress helpers such as sanitize_text_field() for input and esc_html() or esc_attr() for output were not applied to the coupon, start_date, and end_date values before they were echoed in the admin report view.
Attack Vector
The attack is network-based and requires user interaction. An unauthenticated attacker crafts a link to the plugin's admin report endpoint with a payload in one of the vulnerable parameters. The attacker delivers this link through phishing, a forum post, or a malicious page. When a logged-in administrator opens the link, the payload executes in their browser under the WordPress site origin, inheriting their privileges for the duration of that session.
See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Report line 95 for the affected code.
Detection Methods for CVE-2024-11369
Indicators of Compromise
- Web server access logs containing requests to admin/report.php with coupon, start_date, or end_date parameters holding HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
- URL-encoded payload fragments like %3Cscript%3E, %3Cimg%20src%3D, or %22%3E%3Csvg appearing in query strings targeting the plugin.
- Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after visiting a plugin admin page.
- Creation of new WordPress administrator accounts or unauthorized plugin installations without a corresponding legitimate admin action.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect query parameters targeting store-credit-for-woocommerce endpoints for XSS payload signatures.
- Correlate WordPress audit logs of admin session activity with web server logs to identify report page loads containing suspicious parameter values.
- Alert on administrator browser sessions that trigger DOM sinks or unusual JavaScript execution on plugin admin pages.
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture administrator navigation and settings changes tied to the WooCommerce plugin.
- Forward web server and WordPress audit logs to a centralized analytics platform for retention and correlation.
- Monitor for changes to user roles, new administrator accounts, and modifications to wp-config.php or theme files following any suspicious admin activity.
How to Mitigate CVE-2024-11369
Immediate Actions Required
- Update the Store Credit / Gift Cards for WooCommerce plugin to the latest available version that includes the fix from WordPress Changeset 3213698.
- Audit administrator accounts and reset credentials for any admin who may have clicked suspicious links referencing the plugin's report endpoint.
- Review WordPress and web server logs for evidence of exploitation attempts against the vulnerable parameters.
Patch Information
The vulnerability was addressed in the plugin repository via WordPress Changeset 3213698, which introduces proper sanitization and escaping for the coupon, start_date, and end_date parameters in admin/report.php. Site owners should upgrade beyond version 1.0.49.46. Refer to the Wordfence Vulnerability Analysis for additional patch details.
Workarounds
- If patching is not immediately possible, deactivate the Store Credit / Gift Cards for WooCommerce plugin until the update can be applied.
- Restrict access to the WordPress admin area by IP allowlisting at the web server or firewall layer.
- Deploy a WAF rule that blocks requests to plugin admin endpoints containing HTML tags or JavaScript keywords in the coupon, start_date, and end_date parameters.
- Enforce administrator use of separate browsers or profiles for WordPress management to limit exposure to phishing links.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.