CVE-2024-11684 Overview
The Kudos Donations plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 3.2.9. The flaw exists in how the plugin handles the s parameter across administrative views, specifically kudos-admin-subscriptions.php and kudos-admin-transactions.php. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction, such as clicking a crafted link. The plugin, distributed by iseard, integrates Mollie payment processing for donation workflows on WordPress sites.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, administrative action hijacking, or redirection to attacker-controlled infrastructure.
Affected Products
- Kudos Donations plugin for WordPress, all versions through 3.2.9
- kudos-admin-subscriptions.php administrative view
- kudos-admin-transactions.php administrative view
Discovery Timeline
- 2024-11-28 - CVE-2024-11684 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11684
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting flaw in the Kudos Donations plugin. The s request parameter, used as a search term within administrative list views, is reflected back into the rendered HTML without proper sanitization or escaping. An attacker who can convince an authenticated WordPress user, typically an administrator reviewing donations or subscriptions, to click a crafted URL can execute JavaScript in the context of the victim's browser session. This can be leveraged to steal session cookies, perform actions on behalf of the administrator, or pivot to further compromise of the WordPress site.
Root Cause
The root cause is missing input sanitization and missing output escaping on the s parameter within the kudos-admin-subscriptions.php and kudos-admin-transactions.php view files. WordPress provides helper functions such as esc_attr(), esc_html(), and sanitize_text_field() for handling untrusted input, but these were not applied to the s parameter before rendering. The vendor fix in version 3.3.0 introduced proper escaping in both view files, as reflected in the plugin changeset.
Attack Vector
Exploitation requires an attacker to craft a URL containing a malicious payload in the s parameter and deliver it to an authenticated WordPress user through phishing, chat, or another social engineering channel. When the victim loads the URL, the payload is reflected into the admin page and executed by the browser. No authentication or existing site privileges are required from the attacker. The scope change reflected in the vulnerability's classification indicates the injected script executes within the security context of the WordPress admin session, expanding the potential impact beyond the vulnerable component alone.
No public proof-of-concept exploit code has been released for this vulnerability. Refer to the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2024-11684
Indicators of Compromise
- HTTP requests to WordPress admin pages containing suspicious script tags, event handlers, or URL-encoded payloads in the s query parameter.
- Unexpected outbound requests from administrator browsers to unknown domains following interaction with Kudos Donations admin pages.
- Presence of Kudos Donations plugin versions 3.2.9 or earlier in the WordPress plugin inventory.
Detection Strategies
- Inspect web server access logs for requests to wp-admin URLs referencing kudos and containing encoded characters such as %3Cscript, onerror=, or javascript: in the s parameter.
- Deploy web application firewall (WAF) rules that identify reflected XSS patterns targeting WordPress query parameters.
- Correlate admin session activity with anomalous JavaScript execution or unexpected DOM modifications on plugin admin views.
Monitoring Recommendations
- Track WordPress plugin inventory to identify installations of Kudos Donations at or below version 3.2.9.
- Monitor administrator authentication events for session anomalies immediately following visits to plugin admin pages.
- Alert on outbound HTTP requests from administrator workstations to newly observed or low-reputation domains.
How to Mitigate CVE-2024-11684
Immediate Actions Required
- Upgrade the Kudos Donations plugin to version 3.3.0 or later on every affected WordPress installation.
- Instruct WordPress administrators to avoid clicking untrusted links, particularly those referencing plugin admin URLs.
- Audit administrator accounts for recent unexpected configuration changes or new user creations.
Patch Information
The vendor addressed the issue in Kudos Donations version 3.3.0. The fix adds proper output escaping to the s parameter within kudos-admin-subscriptions.php and kudos-admin-transactions.php. Review the WordPress Kudos Donations Changeset and WordPress Kudos Transactions Changeset for implementation details.
Workarounds
- Deactivate the Kudos Donations plugin until an upgrade to 3.3.0 or later can be applied.
- Restrict access to the WordPress admin interface using IP allowlists at the web server or WAF layer.
- Configure a Content Security Policy (CSP) that restricts inline script execution within the WordPress admin context.
# Example WAF rule pattern (ModSecurity) to block XSS in the 's' parameter
SecRule ARGS:s "@rx (?i)(<script|onerror=|onload=|javascript:)" \
"id:1002401,phase:2,deny,status:403,msg:'Reflected XSS attempt in Kudos Donations s parameter'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
