CVE-2024-11805: Quick License Manager XSS Vulnerability

CVE-2024-11805 Overview

CVE-2024-11805 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Quick License Manager – WooCommerce Plugin for WordPress. The flaw affects all plugin versions up to and including 2.4.17 and stems from insufficient input sanitization and output escaping on the submit_qlm_products parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an authenticated user's session, enabling session theft, forced administrative actions, or redirection to attacker-controlled content.

Affected Products

Quick License Manager – WooCommerce Plugin for WordPress, versions up to and including 2.4.17
WordPress sites running the vulnerable plugin with WooCommerce integration
Any WordPress administrator or user session exposed to attacker-supplied links targeting the plugin

Discovery Timeline

2024-12-03 - CVE-2024-11805 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11805

Vulnerability Analysis

The vulnerability is a Reflected XSS issue in the Quick License Manager – WooCommerce Plugin. Attacker-supplied input passed through the submit_qlm_products parameter is reflected back into rendered HTML without adequate sanitization or contextual output escaping. Because the attack vector is over the network and requires no privileges, any visitor who can be lured into clicking a crafted link becomes a potential victim. User interaction is required, and the scope is changed, meaning injected script can impact resources beyond the vulnerable component's security boundary — such as the surrounding WordPress admin session.

Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser context. Consequences include session cookie theft, cross-site request forgery against administrative endpoints, credential harvesting through injected forms, and drive-by redirection to malicious infrastructure.

Root Cause

The root cause is missing input validation combined with unsafe output rendering of the submit_qlm_products parameter. The plugin echoes attacker-controlled request data back into the response HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> tags and event handler attributes to be reflected into the DOM.

Attack Vector

The attack vector is a crafted URL containing a malicious payload in the submit_qlm_products parameter. The attacker delivers this link through phishing email, malicious advertisement, social media, or a compromised third-party site. When the target — typically an authenticated WordPress user or administrator — follows the link, the browser executes the injected script in the origin of the WordPress site. See the Wordfence Vulnerability Report and the WordPress Plugin Update Note for technical context.

Detection Methods for CVE-2024-11805

Indicators of Compromise

HTTP requests containing the submit_qlm_products parameter with URL-encoded <script>, javascript:, or on*= event handler payloads
Referrer headers on WordPress admin pages originating from unknown external domains
Outbound browser requests from admin sessions to unfamiliar third-party hosts shortly after a click event
Unexpected administrator actions such as user creation, plugin installation, or option changes without corresponding console activity

Detection Strategies

Inspect web server and WAF logs for requests to plugin endpoints that include submit_qlm_products parameter values containing HTML tags, encoded angle brackets, or JavaScript URI schemes
Deploy WAF rules that flag reflected XSS patterns in query strings and POST bodies targeting /wp-content/plugins/quick-license-manager/ paths
Monitor DOM-level browser telemetry on administrative workstations for script execution originating from URL parameters

Monitoring Recommendations

Alert on WordPress admin sessions issuing requests from URLs that carry reflected parameter values matching XSS signatures
Track plugin version inventory across WordPress deployments to identify installations still running 2.4.17 or earlier
Correlate phishing email telemetry with clicks to WordPress admin URLs containing the vulnerable parameter

How to Mitigate CVE-2024-11805

Immediate Actions Required

Update the Quick License Manager – WooCommerce Plugin to the version released after 2.4.17 that includes the fix referenced in changeset 3198437
Audit administrator accounts for unauthorized changes, new users, or modified plugin configurations
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected
Enable a Web Application Firewall with signatures for reflected XSS targeting WordPress plugins

Patch Information

The vendor addressed the vulnerability in a plugin release following version 2.4.17. The upstream code change is available in the WordPress Plugin Trac changeset 3198437. Administrators should apply the update through the WordPress plugin manager or by deploying the patched version manually.

Workarounds

Disable the Quick License Manager – WooCommerce Plugin until the patched version can be installed
Restrict access to the WordPress admin interface using IP allowlists or VPN-only access to reduce phishing exposure
Deploy a Content Security Policy (CSP) that restricts inline script execution and unauthorized script sources
Train administrators to avoid clicking untrusted links that reference WordPress admin URLs with query parameters

bash

# Configuration example: WP-CLI commands to inventory and update the plugin
wp plugin list --name=quick-license-manager --fields=name,status,version
wp plugin update quick-license-manager
wp plugin deactivate quick-license-manager  # temporary workaround if update is unavailable