CVE-2024-11400: HUSKY Products Filter XSS Vulnerability

CVE-2024-11400 Overview

CVE-2024-11400 is a Reflected Cross-Site Scripting (XSS) vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. The flaw exists in the really_curr_tax parameter and affects all plugin versions up to and including 1.3.6.3. The root cause is insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts into pages, which execute when a victim clicks a crafted link. Successful exploitation can lead to session compromise, credential theft, and administrative action abuse in the context of the targeted user.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling account takeover and content manipulation on affected WooCommerce storefronts.

Affected Products

Pluginus HUSKY – Products Filter Professional for WooCommerce (WordPress plugin)
All versions up to and including 1.3.6.3
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2024-11-19 - CVE-2024-11400 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11400

Vulnerability Analysis

The vulnerability is a Reflected XSS flaw triggered through the really_curr_tax HTTP parameter. The plugin reflects the value of this parameter back into rendered HTML output without applying adequate sanitization or context-aware output escaping. Because the payload is reflected in server responses, an attacker can construct a URL containing malicious JavaScript and deliver it to a victim through phishing, social engineering, or a malicious referrer.

When the victim visits the crafted URL, the browser parses the injected payload as part of the trusted site's document. The injected script executes with the origin of the WooCommerce store. This grants the attacker access to the victim's cookies, localStorage, and any authenticated session state associated with the site.

The scope-changed CVSS vector indicates the impact can extend beyond the vulnerable component. This is consistent with browser same-origin behavior, where an XSS payload can pivot across plugin boundaries within a single WordPress site.

Root Cause

The underlying defect is missing input validation and missing output escaping on the really_curr_tax request parameter. The plugin does not apply WordPress-native sanitization functions such as sanitize_text_field() on input, nor context-appropriate escaping functions such as esc_html(), esc_attr(), or esc_url() on output. Untrusted request data flows directly into HTML markup, violating standard WordPress plugin security requirements.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing at a vulnerable WooCommerce page and appends a malicious really_curr_tax query string value containing JavaScript. The attacker distributes the URL via email, social media, forum posts, or malicious advertising. When a user, including an authenticated administrator, follows the link, the payload executes in their browser. The vulnerability is exploitable without authentication, and the attacker never needs direct access to the target site.

No verified public proof-of-concept code has been released for this CVE. Technical remediation details are documented in the plugin's WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-11400

Indicators of Compromise

Web server access logs containing requests with really_curr_tax parameter values that include HTML tags, <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unusual outbound requests from browser sessions of WordPress administrators immediately after clicking external links to the storefront.
Unexpected creation of WordPress admin users or plugin/theme installations following administrator link-click activity.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings for reflected script payloads targeting the really_curr_tax parameter.
Correlate WordPress wp-admin privileged actions with preceding referrer chains that include suspicious external URLs.
Baseline expected values for filter parameters used by the HUSKY plugin and alert on deviations containing HTML metacharacters.

Monitoring Recommendations

Enable verbose HTTP request logging on WooCommerce endpoints and forward logs to a centralized analytics platform for query-string inspection.
Monitor Content Security Policy (CSP) violation reports to identify blocked inline script execution attempts.
Track plugin version inventory across WordPress sites and alert when instances of HUSKY Products Filter remain at 1.3.6.3 or earlier.

How to Mitigate CVE-2024-11400

Immediate Actions Required

Update the HUSKY – Products Filter Professional for WooCommerce plugin to the version released after 1.3.6.3 that includes the fix from changeset 3186438.
Audit WordPress administrator accounts for unexpected sessions, new users, or unauthorized configuration changes.
Force a password reset and session invalidation for administrator and shop-manager accounts on affected sites.

Patch Information

The vendor addressed the flaw in the plugin update tracked by WordPress Plugin Changeset 3186438. The fix applies proper sanitization and escaping to the really_curr_tax parameter. Site owners should update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Confirmation and additional context are available in the Wordfence Vulnerability Report.

Workarounds

Deploy a WAF rule to block or sanitize requests containing HTML or script content in the really_curr_tax query parameter until patching is complete.
Implement a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.
Temporarily deactivate the HUSKY Products Filter Professional plugin on high-value WooCommerce sites where immediate patching is not feasible.

bash

# Example WAF rule fragment (ModSecurity) to block script payloads in the vulnerable parameter
SecRule ARGS:really_curr_tax "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1024111400,phase:2,deny,status:403,log,msg:'CVE-2024-11400 HUSKY XSS attempt blocked'"