CVE-2024-12337: Planzer WooCommerce Plugin XSS Vulnerability

CVE-2024-12337 Overview

CVE-2024-12337 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Shipping via Planzer for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.0.25. It stems from insufficient input sanitization and output escaping on the processed-ids parameter [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim is tricked into clicking a crafted link.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's session, potentially leading to session hijacking, credential theft, or unauthorized plugin actions within the WordPress admin.

Affected Products

Shipping via Planzer for WooCommerce plugin for WordPress
All versions up to and including 1.0.25
WordPress sites running WooCommerce with the vulnerable plugin

Discovery Timeline

2025-01-08 - CVE-2024-12337 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12337

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the plugin's handling of the processed-ids request parameter. The plugin reflects the parameter value back into a rendered page without applying proper sanitization on input or escaping on output. Reflected XSS requires user interaction, typically clicking a crafted URL, but the attack requires no authentication. Because the payload executes in the victim's browser session, it can access cookies, session tokens, and perform authenticated actions if the victim is logged in.

Root Cause

The root cause is the plugin's failure to apply WordPress-standard sanitization functions such as sanitize_text_field() on input and escaping functions such as esc_html(), esc_attr(), or esc_url() on output for the processed-ids parameter. Untrusted request data flows directly into HTML context, allowing attacker-controlled markup to break out of the intended value context and execute as script.

Attack Vector

An attacker crafts a URL targeting a vulnerable endpoint of the plugin with a malicious payload in the processed-ids parameter. The attacker delivers the URL via phishing email, social media, or malicious redirects. When a WordPress administrator or authenticated user clicks the link, the injected script executes in their browser under the site's origin. The attacker can then steal session cookies, perform actions on behalf of the user, or pivot to further attacks against the WordPress installation. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component into the browser's origin trust boundary.

No public proof-of-concept exploit code has been verified for this vulnerability. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-12337

Indicators of Compromise

Web server access logs containing requests with processed-ids parameter values holding HTML tags, JavaScript keywords, or URL-encoded script payloads such as %3Cscript%3E.
Referrer headers from external domains preceding suspicious requests to plugin endpoints under /wp-content/plugins/wc-planzer-shipping/.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following an admin session.

Detection Strategies

Deploy a web application firewall rule to flag or block requests where processed-ids contains characters like <, >, ", or ' before URL decoding.
Review historical HTTP access logs for GET requests targeting the Planzer shipping plugin routes with anomalous query strings.
Monitor WordPress audit logs for administrator actions immediately following link-click events from external referrers.

Monitoring Recommendations

Alert on any administrator session that executes unusual admin AJAX requests shortly after loading a URL containing processed-ids.
Correlate browser-side Content Security Policy (CSP) violation reports with WordPress admin activity to surface injection attempts.
Track plugin version inventory across managed WordPress sites and alert when versions at or below 1.0.25 are observed.

How to Mitigate CVE-2024-12337

Immediate Actions Required

Update the Shipping via Planzer for WooCommerce plugin to the version released after 1.0.25 that includes the sanitization fix.
Audit administrator accounts for unexpected activity, and rotate WordPress admin credentials and session tokens if exploitation is suspected.
Notify administrators and site editors of active phishing risk targeting the plugin and instruct them to avoid clicking untrusted links.

Patch Information

The vendor addressed the vulnerability in a plugin update tracked in the WordPress Plugin Changeset 3214785. Site administrators should upgrade to a version higher than 1.0.25 through the WordPress plugin management interface or by deploying the patched plugin package directly.

Workarounds

Deactivate and remove the Shipping via Planzer for WooCommerce plugin until a patched version is installed.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Deploy a web application firewall rule that blocks requests containing script tags or JavaScript event handlers in the processed-ids query parameter.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in processed-ids
SecRule ARGS:processed-ids "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "id:1002024,phase:2,deny,status:403,log,\
    msg:'CVE-2024-12337 - Reflected XSS attempt in processed-ids parameter'"