CVE-2024-13363: Raptive Ads XSS Vulnerability in WordPress

CVE-2024-13363 Overview

CVE-2024-13363 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Raptive Ads plugin for WordPress. The flaw exists in the handling of the poc parameter and affects all plugin versions up to and including 3.6.3. The root cause is insufficient input sanitization and output escaping in a static HTML partial shipped with the plugin.

Unauthenticated attackers can craft a URL containing malicious JavaScript in the poc parameter. When a victim clicks the link, the injected script executes in the victim's browser session against the vulnerable WordPress site.

Critical Impact
Successful exploitation allows arbitrary script execution in a victim's browser, enabling session theft, credential harvesting, or forced administrative actions on WordPress sites running the vulnerable plugin.

Affected Products

Raptive Ads plugin for WordPress (formerly AdThrive Ads)
All versions up to and including 3.6.3
WordPress installations with the adthrive-ads plugin active

Discovery Timeline

2025-02-19 - CVE-2024-13363 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13363

Vulnerability Analysis

The vulnerability resides in a static HTML partial delivered by the plugin under components/static-files/partials/eyereturn/eyereturn.html. The file reflects the poc query parameter value into the rendered page without sanitizing input or escaping output. This allows an attacker-controlled string to be interpreted as HTML or JavaScript by the victim's browser.

Because the injection occurs before authentication, no valid WordPress account is required to weaponize the flaw. The attack requires user interaction: a victim must load a URL crafted by the attacker. Successful exploitation runs script in the victim's browser under the origin of the vulnerable site.

Impact depends on the victim's role. If an authenticated administrator triggers the payload, the attacker can perform actions in the WordPress admin interface, exfiltrate session cookies, or plant persistent backdoors through plugin or theme edits.

Root Cause

The partial file consumes the poc request parameter and writes it into the response body without applying WordPress escaping functions such as esc_html(), esc_attr(), or esc_url(). Static HTML partials bypass the sanitization layers commonly applied to PHP-rendered output, so any reflected value is emitted verbatim.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker constructs a URL referencing the vulnerable partial with a JavaScript payload in the poc parameter, then delivers the link through phishing email, social media, or a malicious referrer. When a target loads the URL, the injected script executes within the site's origin, granting the attacker access to cookies, DOM state, and any privileges the victim holds.

No working exploit code has been published in a verified repository. See the Wordfence CVE Vulnerability Report and the WordPress Plugin HTML Partial for the affected source.

Detection Methods for CVE-2024-13363

Indicators of Compromise

Web server access logs containing requests to /wp-content/plugins/adthrive-ads/components/static-files/partials/eyereturn/eyereturn.html with a populated poc parameter.
URL-encoded script tags, javascript: URIs, or event handler strings (onerror=, onload=) inside the poc query value.
Referrer headers pointing to attacker-controlled domains preceding requests to the vulnerable partial.

Detection Strategies

Alert on HTTP requests to the Raptive Ads plugin static file paths that include query parameters, since the partial is normally requested without user-supplied input.
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payload patterns in query strings targeting /wp-content/plugins/adthrive-ads/.
Correlate anomalous outbound requests from administrator browsers immediately following visits to WordPress pages hosting the vulnerable plugin.

Monitoring Recommendations

Inventory WordPress sites and confirm which run the adthrive-ads plugin at version 3.6.3 or earlier.
Monitor plugin update telemetry to verify upgrades reach every affected site and no rollbacks occur.
Review WordPress administrator session activity for unexpected content changes, new users, or plugin installs after suspected exploitation attempts.

How to Mitigate CVE-2024-13363

Immediate Actions Required

Upgrade the Raptive Ads plugin to a version later than 3.6.3 that includes the fix from WordPress Changeset #3244125.
Audit WordPress administrator accounts and rotate session cookies and passwords if suspicious requests to the eyereturn.html partial appear in logs.
Enable a Content Security Policy (CSP) that restricts inline script execution on the WordPress site to reduce the impact of any reflected payload.

Patch Information

The vendor addressed the vulnerability in the plugin repository via WordPress Changeset #3244125. Site owners should apply the update through the WordPress plugin update mechanism. Additional context is available in the Wordfence CVE Vulnerability Report.

Workarounds

Block requests to /wp-content/plugins/adthrive-ads/components/static-files/partials/eyereturn/eyereturn.html at the reverse proxy or WAF when patching is delayed.
Deactivate the Raptive Ads plugin until it can be updated to a fixed release.
Deny query strings on requests to the plugin's static partial files using a web server rewrite rule.

bash

# Example nginx rule to block requests with query parameters to the vulnerable partial
location ~* /wp-content/plugins/adthrive-ads/components/static-files/partials/eyereturn/eyereturn\.html$ {
    if ($args) {
        return 403;
    }
}