CVE-2024-12214: WooCommerce HSS Extension XSS Vulnerability

CVE-2024-12214 Overview

CVE-2024-12214 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WooCommerce HSS Extension for Streaming Video plugin for WordPress. The flaw affects all versions of the plugin up to and including 3.31. It stems from insufficient input sanitization and output escaping on the videolink parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when they click a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions in the WordPress site context.

Affected Products

WooCommerce HSS Extension for Streaming Video plugin for WordPress
All plugin versions up to and including 3.31
WordPress sites running WooCommerce with the affected extension installed

Discovery Timeline

2025-01-07 - CVE-2024-12214 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12214

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the WooCommerce HSS Extension for Streaming Video plugin. User-controlled input passed through the videolink request parameter is reflected in the server's HTTP response without adequate sanitization or output encoding. When a victim visits a URL crafted by an attacker, the injected payload executes in the context of the WordPress site's origin.

Exploitation requires user interaction, typically through phishing or a malicious link embedded in email, chat, or a third-party site. Successful exploitation can lead to session cookie theft, forced browser actions, redirection to attacker-controlled infrastructure, or defacement of rendered content. Because the plugin operates within a WooCommerce storefront, injected scripts can also target checkout flows or logged-in administrators browsing the site.

Root Cause

The plugin fails to apply proper input sanitization on the videolink parameter and does not escape the value before writing it to the HTTP response body. WordPress provides helpers such as sanitize_text_field() for input handling and esc_url() or esc_attr() for output contexts, but the affected code paths omit these controls. This omission allows attacker-supplied HTML and JavaScript payloads to be rendered as executable markup.

Attack Vector

An attacker crafts a URL to a vulnerable page containing a malicious payload in the videolink query parameter. The attacker distributes this URL through phishing, social media, or malvertising. When a target clicks the link, the server reflects the payload into the response, and the browser executes it under the site's origin. No authentication is required to construct the exploit URL, though a victim must be tricked into visiting it.

Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-12214

Indicators of Compromise

HTTP requests containing suspicious content in the videolink parameter, including URL-encoded <script>, javascript:, or event handler strings such as onerror= and onload=.
Web server access logs showing external referrers directing users to plugin endpoints with unusually long or encoded videolink values.
Unexpected outbound requests from browser sessions to attacker-controlled domains after users interact with plugin-served pages.

Detection Strategies

Inventory WordPress installations to identify sites running the WooCommerce HSS Extension for Streaming Video plugin at version 3.31 or earlier.
Deploy a Web Application Firewall (WAF) rule to inspect the videolink parameter for HTML tags, script constructs, and encoded XSS payloads.
Correlate WordPress access logs with endpoint telemetry to identify users who followed suspicious external links into the site.

Monitoring Recommendations

Enable verbose logging on the WordPress web server and forward logs to a centralized SIEM for query parameter analysis.
Monitor for anomalous JavaScript execution and unexpected DOM modifications on plugin-rendered pages using browser telemetry or Content Security Policy (CSP) violation reports.
Track privileged administrator sessions for signs of session token reuse from unexpected IP addresses following plugin page access.

How to Mitigate CVE-2024-12214

Immediate Actions Required

Deactivate the WooCommerce HSS Extension for Streaming Video plugin on all affected WordPress sites until a patched version is confirmed available.
Apply a WAF rule to block requests containing script tags, event handlers, or javascript: schemes in the videolink parameter.
Notify administrators and content editors to avoid clicking untrusted links referencing plugin URLs, and rotate WordPress admin session cookies.

Patch Information

At the time of the last NVD update, no fixed version is identified in the referenced advisory. Monitor the plugin's developer page on WordPress.org and the Wordfence Vulnerability Report for patch release information, and update to any version released after 3.31 that explicitly addresses this issue.

Workarounds

Remove or disable the plugin entirely if the streaming video functionality is not business-critical.
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of reflected XSS payloads.
Configure the web server or reverse proxy to strip or reject requests containing HTML metacharacters in the videolink parameter until a vendor patch is applied.

bash

# Example ModSecurity rule to block XSS payloads in the videolink parameter
SecRule ARGS:videolink "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe)" \
    "id:1002214,phase:2,deny,status:403,log,\
    msg:'CVE-2024-12214 - Reflected XSS attempt in videolink parameter'"