CVE-2024-12412: WpRently WordPress Plugin XSS Vulnerability

CVE-2024-12412 Overview

CVE-2024-12412 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently plugin for WordPress. The flaw exists in all versions up to and including 2.2.1 and stems from insufficient input sanitization and output escaping on the active_tab parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the affected page is loaded. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute against any visitor to affected WordPress pages, enabling session theft, admin account takeover, and content manipulation.

Affected Products

WpRently – Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration (WordPress plugin)
All versions up to and including 2.2.1
Fixed in the release corresponding to WordPress Plugin Changeset 3231798

Discovery Timeline

2025-01-11 - CVE-2024-12412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12412

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the WpRently WordPress plugin. Attacker-controlled input supplied through the active_tab request parameter is rendered back into plugin-generated pages without adequate sanitization or output escaping. Because the payload is reflected into HTML context and stored in a location that later serves it to visitors, the injected script executes whenever a user accesses the affected page. Exploitation requires no authentication, though user interaction (visiting a crafted URL or affected page) is required to trigger script execution in the victim's browser.

Root Cause

The root cause is missing input validation and missing output encoding in the plugin's tab-handling logic within the resort_info.php template file. The active_tab parameter value is emitted into HTML without being passed through WordPress escaping functions such as esc_attr(), esc_html(), or sanitize_text_field(). This allows an attacker to break out of the intended attribute context and inject arbitrary <script> tags or event handlers.

Attack Vector

An attacker crafts a malicious URL or request containing a JavaScript payload in the active_tab parameter and delivers it to a target through phishing, forum posts, or embedded links. When a WordPress user, including administrators, loads the affected page, the injected script runs under the site's origin. Because the vulnerability affects a scope beyond the vulnerable component, attackers can steal session cookies, perform actions on behalf of authenticated users, and pivot toward administrative takeover of the WordPress installation.

Refer to the WordPress Plugin Template File and the Wordfence Vulnerability Report for the specific sink location.

Detection Methods for CVE-2024-12412

Indicators of Compromise

Web server access logs containing requests to WpRently plugin endpoints with active_tab parameter values that include <script, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript.
Unexpected outbound requests from browsers of site visitors to attacker-controlled domains, suggesting cookie exfiltration.
New or modified WordPress administrator accounts, plugins, or theme files following suspicious traffic to affected pages.

Detection Strategies

Deploy a web application firewall rule that inspects the active_tab query and POST parameter for HTML tags, JavaScript URI schemes, and event handler attributes.
Correlate WordPress wp-admin privilege changes and plugin installs with prior requests to WpRently URLs that contain suspicious active_tab values.
Scan the WordPress database and rendered pages for stored payloads referencing external script sources or document.cookie access.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-src violations originating from WpRently pages.
Monitor WordPress plugin inventory for the booking-and-rental-manager-for-woocommerce slug and alert on versions at or below 2.2.1.
Review Wordfence or equivalent WordPress security telemetry for signatures matching Wordfence advisory b0cde64f-2533-46e0-9268-b9d100fb0a82.

How to Mitigate CVE-2024-12412

Immediate Actions Required

Update the WpRently plugin to a version later than 2.2.1 that includes the fix from WordPress Changeset #3231798.
Audit WordPress administrator accounts and session tokens; invalidate all active sessions and rotate credentials if exploitation is suspected.
Review recent plugin, theme, and user changes for unauthorized modifications introduced through XSS-driven admin actions.

Patch Information

The WpRently plugin maintainers addressed the vulnerability in WordPress Plugin Changeset 3231798. The fix introduces proper sanitization and output escaping for the active_tab parameter within the resort_info.php template. Site owners should upgrade through the WordPress plugin manager and verify the installed version is above 2.2.1.

Workarounds

If patching is delayed, deactivate the WpRently plugin until the update can be applied.
Deploy a WAF rule that blocks or sanitizes any request containing <, >, or JavaScript event handler substrings within the active_tab parameter.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins on WordPress front-end pages.

bash

# Example WAF/ModSecurity rule to block XSS payloads in active_tab
SecRule ARGS:active_tab "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1002412,phase:2,deny,status:403,log,msg:'CVE-2024-12412 WpRently active_tab XSS attempt'"