CVE-2024-12395: WooCommerce Additional Fees XSS Vulnerability

CVE-2024-12395 Overview

CVE-2024-12395 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce Additional Fees On Checkout (Free) plugin for WordPress. The flaw exists in all versions up to and including 1.4.7 and stems from insufficient input sanitization and output escaping on the number parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The weakness is classified under CWE-79.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in an authenticated user's browser session, enabling session theft, administrative action abuse, and store defacement on WooCommerce sites running the vulnerable plugin.

Affected Products

WooCommerce Additional Fees On Checkout (Free) plugin for WordPress — all versions ≤ 1.4.7
WordPress sites running WooCommerce with the affected plugin installed
Administrative interface file classes/wps-ext-cst-admin.php

Discovery Timeline

2024-12-17 - CVE-2024-12395 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12395

Vulnerability Analysis

The vulnerability is a Reflected XSS flaw in the plugin's admin-side code path. The number request parameter is echoed back into rendered HTML without proper sanitization or contextual output escaping. A malicious payload supplied in the URL is reflected directly into the response and interpreted by the browser as script content.

Because the vulnerable sinks reside in classes/wps-ext-cst-admin.php, exploitation targets users with access to the plugin's admin pages, most commonly WordPress administrators or shop managers. Successful exploitation runs JavaScript under the origin of the WordPress site, granting the attacker the same privileges as the victim's active session.

The Wordfence advisory identifies multiple vulnerable references to the number parameter across the admin class file, including lines 28, 31, 38, 47, 53, 59, 66, 76, 90, 96, 117, 127, 138, 149, 173, and 200, indicating that the same unescaped variable is reused across several form and table rendering routines.

Root Cause

The root cause is a missing pairing of input sanitization and output escaping. WordPress provides functions such as sanitize_text_field() for input handling and esc_attr(), esc_html(), and esc_url() for context-aware output. In the affected plugin, values sourced from the number request parameter are concatenated into HTML attributes and body content without any of these safeguards, producing a classic reflected injection sink.

Attack Vector

Exploitation requires no authentication but does require user interaction. An attacker crafts a URL containing a malicious number query value pointing to the vulnerable plugin admin endpoint and delivers it through phishing, forum posts, or malicious redirects. When an authenticated WordPress administrator opens the link, the injected script executes in their browser under the site's origin. The scope changes because the script runs in the authenticated admin context, allowing session cookie theft, forced administrative actions, or injection of persistent backdoors via other admin functionality.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-12395

Indicators of Compromise

HTTP requests to WordPress admin pages associated with the woo-additional-fees-on-checkout-wordpress plugin containing number= query values that include HTML or script metacharacters such as <, >, ", ', or script.
Referrer logs showing administrators arriving at plugin admin URLs from external or untrusted domains.
New or modified WordPress administrator accounts, plugin installs, or theme file changes following administrator visits to suspicious links.

Detection Strategies

Inspect WordPress access logs for requests to /wp-admin/ paths belonging to the plugin that carry unusually long or encoded number parameter values.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns on the number parameter for the vulnerable plugin endpoints.
Use file integrity monitoring on wp-content/plugins/woo-additional-fees-on-checkout-wordpress/ to identify unpatched installations.

Monitoring Recommendations

Alert on browser-side Content Security Policy (CSP) violations originating from WordPress admin pages, which can surface injection attempts.
Monitor for outbound requests from administrator browsers to unknown domains immediately after visiting WordPress admin URLs.
Track plugin version inventory across WordPress estates and flag any installation of the plugin at version ≤ 1.4.7.

How to Mitigate CVE-2024-12395

Immediate Actions Required

Update the WooCommerce Additional Fees On Checkout (Free) plugin to the version that includes the fix delivered in WordPress Changeset #3208205.
Audit administrator accounts, active sessions, and recently installed plugins or themes for signs of unauthorized changes.
Instruct administrators to avoid clicking untrusted links while authenticated to the WordPress admin console.

Patch Information

The vendor addressed the vulnerability in the plugin trunk via WordPress Changeset #3208205, which introduces sanitization and escaping around the number parameter in classes/wps-ext-cst-admin.php. Refer to the Wordfence Vulnerability Report for the fixed version and additional technical context.

Workarounds

Deactivate and remove the plugin until the patched version can be deployed.
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce the attacker's ability to deliver reflected payloads to admin sessions.
Enforce a strict Content Security Policy for WordPress admin pages to limit inline script execution and constrain the impact of injected payloads.

bash

# Nginx example: restrict WordPress admin to trusted IPs
location ^~ /wp-admin/ {
    allow 203.0.113.10;
    allow 198.51.100.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}