CVE-2024-11685: Kudos Donations Plugin XSS Vulnerability

CVE-2024-11685 Overview

CVE-2024-11685 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Kudos Donations – Easy donations and payments with Mollie plugin for WordPress. The flaw affects all plugin versions up to and including 3.2.9. It stems from the use of add_query_arg without proper escaping of the URL in the TransactionsTable.php controller. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any user who clicks a crafted link. The issue is categorized as an Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Critical Impact
Successful exploitation lets attackers execute arbitrary scripts in the context of an authenticated administrator, enabling session theft, action forgery, or redirection to attacker-controlled infrastructure.

Affected Products

Iseard Kudos Donations plugin for WordPress, all versions up to and including 3.2.9
WordPress sites processing donations through the Mollie payment integration
Administrator sessions loading the plugin's Transactions admin table

Discovery Timeline

2024-11-28 - CVE-2024-11685 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11685

Vulnerability Analysis

The vulnerability resides in the plugin's transactions admin table controller, app/Controller/Table/TransactionsTable.php. The code invokes WordPress's add_query_arg function against the current request URL without first sanitizing or escaping user-controlled input. Because add_query_arg reflects the request URI back into the rendered page, any attacker-supplied query parameters are echoed into HTML attributes. When a victim visits a specially crafted URL, the injected payload is rendered in the response and executed by the browser. This is a classic reflected XSS pattern that requires user interaction but not authentication of the attacker.

Root Cause

The root cause is missing output escaping around a value returned by add_query_arg. WordPress core documentation explicitly warns that add_query_arg and remove_query_arg return raw, unescaped URLs and must be wrapped with esc_url or esc_url_raw before being placed into HTML. The vulnerable versions of Kudos Donations omit this escaping step, allowing crafted parameters in the request URL to break out of the intended attribute context and inject <script> content or event handlers.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL pointing to a WordPress admin page that renders the Kudos Donations transactions table, appending malicious query parameters containing script payloads. The attacker delivers the link through phishing email, a public web page, or a chat message. When an authenticated WordPress administrator clicks the link, the injected script executes under the site's origin. The scope is changed because scripts running in the admin panel can pivot to actions across the WordPress site.

No verified proof-of-concept code is publicly indexed. See the Wordfence Vulnerability Report for additional technical context and the WordPress Plugin Changeset Update for the fix diff.

Detection Methods for CVE-2024-11685

Indicators of Compromise

Web server access logs showing requests to WordPress admin pages with query parameters containing HTML tags, javascript: schemes, or encoded <script> payloads.
Referer headers pointing to unfamiliar external domains preceding administrative activity on the Kudos Donations transactions page.
Unexpected outbound requests from administrator browsers to unknown hosts shortly after visiting a plugin admin URL.

Detection Strategies

Inspect WordPress request logs for query strings containing suspicious characters such as <, >, %3Cscript, or onerror= targeting admin.php?page=kudos-transactions or similar plugin routes.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns in query parameters submitted to /wp-admin/ endpoints.
Query endpoint telemetry for browser processes spawning unusual child processes or making anomalous outbound connections after administrators access WordPress admin URLs.

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress host and forward logs to a centralized analytics platform for pattern detection.
Monitor the wp-content/plugins/kudos-donations/ directory for unexpected file changes that may follow successful admin-session hijack.
Track administrator account activity, including new user creation, role changes, and plugin installations, immediately after any suspicious click-through event.

How to Mitigate CVE-2024-11685

Immediate Actions Required

Upgrade the Kudos Donations plugin to version 3.3.0 or later on all WordPress sites where it is installed.
Audit administrator accounts and rotate credentials for users who may have clicked untrusted links while logged into the WordPress admin panel.
Restrict administrator access to the WordPress backend using IP allow-listing or a VPN to reduce exposure to phishing-delivered links.

Patch Information

The vendor addressed the issue in Kudos Donations version 3.3.0 by applying proper URL escaping in app/Controller/Table/TransactionsTable.php. Review the fix in the WordPress Plugin Changeset Update.

Workarounds

If patching is not immediately possible, deactivate the Kudos Donations plugin until the update can be applied.
Deploy a WAF rule that strips or blocks HTML metacharacters from query parameters delivered to WordPress admin routes.
Enforce a strict Content Security Policy (CSP) on the WordPress admin panel to limit inline script execution.

bash

# Update Kudos Donations to the patched release via WP-CLI
wp plugin update kudos-donations --version=3.3.0

# Verify the installed version after upgrade
wp plugin get kudos-donations --field=version