CVE-2024-13010 Overview
The WP Foodbakery plugin for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.8. The flaw stems from insufficient input sanitization and output escaping on the search_type parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can execute arbitrary JavaScript in the context of a victim's session, enabling session theft, credential harvesting, and unauthorized actions on behalf of authenticated users, including WordPress administrators.
Affected Products
- WP Foodbakery plugin for WordPress versions up to and including 4.8
- WordPress sites using the Food Bakery Restaurant Bakery Responsive WordPress Theme
- Any deployment exposing the vulnerable search_type parameter to unauthenticated users
Discovery Timeline
- 2025-02-10 - CVE-2024-13010 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13010
Vulnerability Analysis
The WP Foodbakery plugin processes the search_type request parameter without applying adequate sanitization or output escaping. When the application reflects the parameter value back into the rendered HTML response, injected script content executes in the victim's browser. Because exploitation requires only a crafted URL and a single click, the vulnerability is well-suited for phishing and social engineering campaigns targeting site administrators or logged-in users.
Root Cause
The root cause is missing input validation and output encoding on the search_type parameter. The plugin echoes user-controlled data into the HTML response without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This violates the OWASP guidance on context-appropriate output encoding and represents a standard reflected XSS pattern.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker crafts a URL containing malicious JavaScript in the search_type query parameter and delivers it through phishing email, social media, or a compromised third-party site. When the victim clicks the link, the injected payload executes in the origin of the vulnerable WordPress site. Because the XSS occurs in a scope that changes the security boundary, attackers can steal authentication cookies, perform actions using the victim's session, or pivot toward WordPress administrator compromise. Refer to the Wordfence vulnerability report for further technical detail.
Detection Methods for CVE-2024-13010
Indicators of Compromise
- Web server access logs containing requests with search_type parameter values that include HTML tags, JavaScript keywords, event handlers such as onerror or onload, or URL-encoded angle brackets (%3C, %3E)
- Referrer headers pointing to external domains followed by requests to WP Foodbakery search endpoints
- Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting the WordPress site
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the search_type parameter for script tags, JavaScript URI schemes, and common XSS payload patterns
- Enable WordPress security plugins that provide signature-based detection for reflected XSS attempts against known vulnerable components
- Review inventory of installed WordPress plugins and themes to identify WP Foodbakery installations at version 4.8 or earlier
Monitoring Recommendations
- Alert on repeated HTTP 200 responses to requests containing suspicious characters in the search_type parameter
- Monitor administrator account activity for anomalous session behavior following user clicks on external links
- Track browser console errors and Content Security Policy (CSP) violation reports if CSP is enforced
How to Mitigate CVE-2024-13010
Immediate Actions Required
- Identify all WordPress sites running the WP Foodbakery plugin at version 4.8 or earlier
- Apply the vendor-supplied patch as soon as a fixed release becomes available from the theme author
- Instruct administrators and privileged users to avoid clicking untrusted links pointing to the WordPress site until patching is complete
Patch Information
At the time of NVD publication, the vulnerability affects all WP Foodbakery versions up to and including 4.8. Site operators should consult the Food Bakery product page on ThemeForest and the Wordfence vulnerability report for updates on a fixed release. Upgrade to the first version above 4.8 that addresses the input sanitization defect once published by the vendor.
Workarounds
- Deploy WAF rules that filter or block requests containing script content in the search_type parameter
- Enforce a strict Content Security Policy (CSP) that disables inline JavaScript execution to reduce XSS impact
- Restrict access to WP Foodbakery search functionality behind authentication or IP allow-listing while awaiting a patch
- Disable or remove the WP Foodbakery plugin if the affected search functionality is not required for site operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.