CVE-2024-13406: Icopydoc XML Merchant Center XSS Flaw

CVE-2024-13406 is a reflected cross-site scripting vulnerability in the Icopydoc XML for Google Merchant Center WordPress plugin that allows unauthenticated attackers to inject malicious scripts via the feed_id parameter. This post covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-13406 Overview

CVE-2024-13406 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the XML for Google Merchant Center plugin for WordPress by icopydoc. The flaw exists in all versions up to and including 3.0.11. The plugin fails to properly sanitize input and escape output for the feed_id parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser session when the victim clicks a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user, including administrators, who is tricked into clicking a malicious link, enabling session theft, account takeover, or administrative action hijacking.

Affected Products

icopydoc XML for Google Merchant Center plugin for WordPress
All versions up to and including 3.0.11
WordPress sites running the plugin with default configuration

Discovery Timeline

2025-01-22 - CVE-2024-13406 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13406

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the XML for Google Merchant Center plugin. The plugin processes the feed_id request parameter and reflects its value back into rendered HTML output without adequate sanitization or contextual output escaping. Because the injection point is reflected and the attack is delivered through a crafted URL, exploitation requires user interaction such as clicking a malicious link. Successful exploitation runs attacker-controlled JavaScript in the origin of the WordPress site, allowing session cookie theft, forced administrative actions, credential harvesting, or redirection to attacker infrastructure.

Root Cause

The root cause is insufficient input sanitization and missing output escaping when handling the feed_id parameter. The plugin trusts the parameter value and emits it into an HTML context without functions such as esc_html(), esc_attr(), or sanitize_text_field(), which are the WordPress standard mitigations for reflected input.

Attack Vector

Exploitation requires no authentication. An attacker crafts a URL containing a malicious payload in the feed_id parameter and delivers it through phishing, chat, forum posts, or malvertising. When a victim, ideally an authenticated administrator, follows the link, the injected script executes with the privileges of that session. The scope change indicated by the CVSS vector reflects that the impact extends beyond the vulnerable plugin to the victim's browser trust boundary.

No verified public proof-of-concept code is available. For technical detail, see the Wordfence Vulnerability Report and the WordPress Plugin Changeset that contains the fix.

Detection Methods for CVE-2024-13406

Indicators of Compromise

HTTP request logs containing the feed_id parameter with URL-encoded HTML tags such as %3Cscript%3E, onerror=, or javascript: schemes.
Referrer headers pointing to external domains combined with WordPress admin URLs that include the feed_id parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links.

Detection Strategies

Deploy web application firewall (WAF) rules that block requests where feed_id contains HTML metacharacters (<, >, ", ') or JavaScript keywords.
Monitor WordPress access logs for anomalous query strings targeting plugin endpoints associated with xml-for-google-merchant-center.
Correlate reflected parameter values with response bodies to identify unescaped user input reaching the rendered DOM.

Monitoring Recommendations

Enable browser Content Security Policy (CSP) reporting to capture inline script violations originating from plugin pages.
Alert on administrator sessions performing unusual privileged actions immediately after external referrer navigation.
Ingest WordPress and WAF logs into a centralized analytics platform to baseline plugin parameter usage and flag deviations.

How to Mitigate CVE-2024-13406

Immediate Actions Required

Upgrade the XML for Google Merchant Center plugin to a version later than 3.0.11 as soon as the vendor publishes a fixed release.
If a patched version is not yet installed, deactivate and remove the plugin from all affected WordPress sites.
Force a password reset and re-authentication for administrator accounts that may have clicked untrusted links while the plugin was active.

Patch Information

The vendor addressed the input handling in the plugin repository. Review the WordPress Plugin Changeset that introduces sanitization for the feed_id parameter, and consult the Wordfence Vulnerability Report for the tracked fixed version.

Workarounds

Add WAF rules to strip or block HTML metacharacters in the feed_id query parameter on all WordPress endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Train administrators to avoid clicking WordPress admin URLs received from untrusted sources and to use isolated browser profiles for site management.

bash

# Example ModSecurity rule blocking script tags in the feed_id parameter
SecRule ARGS:feed_id "@rx (?i)(<script|onerror=|javascript:|<img|<svg)" \
    "id:1013406,phase:2,deny,status:403,log,\
     msg:'CVE-2024-13406 XSS attempt in feed_id parameter'"