CVE-2024-12467: Grafreak Payment By Redsys XSS Vulnerability

CVE-2024-12467 Overview

The Pago por Redsys plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the Ds_MerchantParameters parameter. The flaw affects all versions up to and including 1.0.12 and stems from insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability was addressed in version 1.0.13 of the plugin, distributed through the WordPress plugin repository under the slug pago-redsys-tpv-grafreak.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the victim's browser session, enabling session theft, credential harvesting, and redirection to attacker-controlled infrastructure.

Affected Products

Grafreak Payment By Redsys (payment_by_redsys) WordPress plugin, versions 1.0.0 through 1.0.12
WordPress sites processing Redsys payment gateway transactions
Any deployment relying on the vulnerable class-redsysapi.php handler

Discovery Timeline

2025-02-22 - CVE CVE-2024-12467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12467

Vulnerability Analysis

The vulnerability resides in how the plugin processes the Ds_MerchantParameters query parameter returned from the Redsys payment gateway. The parameter value flows into the plugin's public display logic without proper sanitization or output escaping before rendering in the response page. An attacker can craft a URL containing malicious JavaScript payloads within this parameter and deliver it to a victim through phishing, social engineering, or a malicious link embedded in a trusted context. When the victim visits the crafted URL, the payload executes in the browser under the site's origin.

Root Cause

The root cause is missing input validation and improper output encoding in the plugin's public-facing handler. The vulnerable code paths are located in includes/class-redsysapi.php around line 263 and in public/partials/pago-redsys-grafreak-public-display.php around line 82. User-controlled data reaches the HTML response context without being passed through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

Exploitation requires no authentication but depends on user interaction. The attacker constructs a URL containing a malicious payload in the Ds_MerchantParameters parameter and lures a victim into visiting it. Because the payload executes within the site's origin, attackers can steal session cookies, perform actions on behalf of authenticated users, or inject fake login forms. Administrators visiting the crafted URL are particularly at risk, since script execution in their session can escalate to persistent site compromise.

See the Wordfence Vulnerability Analysis and the WordPress Plugin RedsysAPI Code for the affected code paths.

Detection Methods for CVE-2024-12467

Indicators of Compromise

HTTP requests to WordPress endpoints containing Ds_MerchantParameters with URL-encoded <script>, javascript:, or event handler payloads such as onerror= and onload=.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from pages served by the vulnerable plugin.
Access log entries showing unusually long or Base64-encoded values in the Ds_MerchantParameters query string.

Detection Strategies

Inspect web server and WAF logs for reflected XSS patterns in the Ds_MerchantParameters parameter, including HTML entities and encoded angle brackets.
Enumerate WordPress installations to identify sites running pago-redsys-tpv-grafreak versions at or below 1.0.12.
Correlate anomalous administrator session activity with prior visits to URLs containing the vulnerable parameter.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked script executions on pages served by the plugin.
Alert on WordPress plugin version inventory drift and flag any host still exposing the vulnerable versions.
Monitor referrer headers on Redsys payment callback URLs for suspicious external origins.

How to Mitigate CVE-2024-12467

Immediate Actions Required

Update the Pago por Redsys plugin to version 1.0.13 or later on all WordPress installations.
Audit all sites using the plugin and force administrator password resets if compromise is suspected.
Deploy a WAF rule to block requests containing script tags or JavaScript event handlers in the Ds_MerchantParameters parameter until patching is complete.

Patch Information

The vendor resolved the issue in version 1.0.13 by adding proper input sanitization and output escaping to the affected handlers. Review the WordPress Plugin Changeset History for the applied fix and validate the update through the WordPress admin dashboard.

Workarounds

Disable and remove the plugin if immediate patching is not feasible and Redsys payment processing is not business-critical.
Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected script injection.
Restrict administrator access to trusted IP ranges to limit exposure to social-engineering-driven exploitation.

bash

# Update the plugin via WP-CLI
wp plugin update pago-redsys-tpv-grafreak --version=1.0.13

# Verify installed version
wp plugin get pago-redsys-tpv-grafreak --field=version