CVE-2024-12160 Overview
CVE-2024-12160 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Seraphinite Bulk Discounts for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 2.4.6 and stems from the use of add_query_arg without appropriate escaping of the URL. Unauthenticated attackers can inject arbitrary web scripts into affected pages. Exploitation requires user interaction, such as clicking a crafted link. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or redirection when a WooCommerce site administrator or shopper follows a malicious link.
Affected Products
- Seraphinite Bulk Discounts for WooCommerce plugin for WordPress
- All versions up to and including 2.4.6
- WordPress sites running WooCommerce with this plugin enabled
Discovery Timeline
- 2024-12-12 - CVE-2024-12160 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12160
Vulnerability Analysis
The vulnerability is a Reflected XSS flaw in the Seraphinite Bulk Discounts for WooCommerce plugin. Reflected XSS occurs when user-controlled input is echoed back into an HTTP response without proper output encoding. In this case, the plugin invokes WordPress's add_query_arg function to build URLs but fails to escape the resulting output before rendering it in the page.
The add_query_arg function is a common source of reflected XSS in WordPress plugins because it inherits the current request URI when no explicit URL is supplied. Attacker-controlled query string parameters are then reflected into HTML attributes such as href, allowing script injection when the output is not passed through esc_url or a similar sanitizer.
Exploitation requires the victim to click a specially crafted link. Successful attacks execute JavaScript in the context of the vulnerable WordPress site, enabling session theft, administrative action forgery, or malicious redirection.
Root Cause
The root cause is missing output escaping around the URL returned by add_query_arg in the plugin's Cmn/Plugin.php source file. Because the returned string can contain attacker-supplied query parameters, injecting HTML or JavaScript payloads becomes possible when the value is rendered without esc_url. See the WordPress Plugin Code Review for the affected code path.
Attack Vector
An attacker crafts a URL to a page on the vulnerable WordPress site containing a malicious query string that breaks out of the reflected attribute context. The attacker delivers the URL through phishing, forum posts, or malicious advertisements. When a victim clicks the link, the injected script executes in their browser under the site's origin. The scope is changed because the injected script can access resources beyond the vulnerable component's security context.
No authentication is required to craft or deliver the payload. The vulnerability is described in the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-12160
Indicators of Compromise
- HTTP requests to WordPress pages containing suspicious query string parameters with <script>, javascript:, or encoded HTML payloads
- Referrer logs showing external hosts sending users to plugin-controlled URLs with anomalous query parameters
- Browser console errors or unexpected outbound requests originating from WooCommerce store pages
- Session cookies or WordPress admin credentials appearing on unrelated hosts shortly after user click activity
Detection Strategies
- Inspect web server access logs for URI patterns targeting the Seraphinite plugin with encoded script content in query parameters
- Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS payloads against WordPress query strings
- Enumerate installed WordPress plugins and flag any instance of seraphinite-discount-for-woocommerce at version 2.4.6 or earlier
- Monitor Content Security Policy (CSP) violation reports for inline script execution originating from plugin pages
Monitoring Recommendations
- Enable verbose HTTP request logging on WordPress front-end pages and forward logs to a centralized SIEM for pattern analysis
- Alert on outbound HTTP requests from administrator browsers to unknown domains immediately after WooCommerce page visits
- Track WordPress admin session creation events for anomalous IP addresses or user agent strings
How to Mitigate CVE-2024-12160
Immediate Actions Required
- Update the Seraphinite Bulk Discounts for WooCommerce plugin to a version newer than 2.4.6 as soon as a patched release is available
- If no patch is available, deactivate and remove the plugin until a fixed version is published
- Instruct WordPress administrators to avoid clicking untrusted links to the store domain and to use dedicated administrative browsers
- Rotate WordPress administrator credentials and invalidate active sessions if suspicious click activity has been observed
Patch Information
Review the vendor's WordPress Changeset Update for the code changes tracked in the plugin repository. Site owners should upgrade to the latest available plugin version from the WordPress.org plugin directory and verify the reported version in the WordPress admin dashboard after the update.
Workarounds
- Deploy a WAF ruleset that blocks reflected XSS payloads in query parameters targeting WordPress URLs
- Enforce a strict Content Security Policy on the WooCommerce site to prevent inline script execution and restrict allowed script sources
- Restrict administrative access to the WordPress dashboard by IP allowlist to reduce exposure of privileged sessions
- Require multi-factor authentication for all WordPress accounts with elevated privileges to limit impact of session theft
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.