CVE-2024-13728: WordPress PayPal & Stripe Plugin XSS Flaw

CVE-2024-13728 Overview

CVE-2024-13728 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Accept Donations with PayPal & Stripe plugin for WordPress. The flaw affects all versions up to and including 1.4.4. The vulnerability resides in the handling of the rf parameter, which lacks sufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session theft, credential harvesting, or unauthorized actions performed on behalf of an authenticated administrator.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who clicks a malicious link, enabling account takeover of privileged WordPress users.

Affected Products

WordPress plugin: Accept Donations with PayPal & Stripe (easy-paypal-donation)
All plugin versions up to and including 1.4.4
WordPress sites running the vulnerable plugin with the Stripe donation flow enabled

Discovery Timeline

2025-02-23 - CVE-2024-13728 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13728

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw classified under [CWE-79]. The plugin accepts the rf request parameter and reflects its value into a rendered page without applying adequate sanitization or context-appropriate output escaping. Because the input is echoed back to the browser as part of an HTML response, an attacker can craft a URL containing JavaScript payloads within the rf parameter.

When a targeted user, especially an authenticated site administrator, follows the attacker's link, the injected script executes in the context of the WordPress site's origin. This grants the attacker access to session cookies, DOM content, and any authenticated actions the victim can perform. The vulnerable code path is located in the plugin's Stripe handler, referenced in the WordPress Plugin Source Code.

Root Cause

The root cause is missing input validation and missing output escaping around the rf parameter. WordPress provides functions such as esc_html(), esc_attr(), and sanitize_text_field() for exactly this scenario, but the plugin renders the parameter value directly into HTML output without invoking them.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing a JavaScript payload appended to the rf parameter and delivers it via phishing email, social media, or a malicious website. When the victim loads the URL, the reflected payload executes in the site's context. Additional details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13728

Indicators of Compromise

HTTP requests containing the rf query parameter with characters such as <, >, ", ', or URL-encoded equivalents (%3C, %3E)
Access log entries referencing the plugin path easy-paypal-donation with unusually long or encoded rf values
Referrer headers pointing to attacker-controlled domains for requests hitting donation endpoints
Unexpected outbound requests from administrator browsers following clicks on donation-related URLs

Detection Strategies

Deploy web application firewall rules that flag script-like patterns (<script, onerror=, javascript:) in query strings targeting /wp-content/plugins/easy-paypal-donation/
Correlate WordPress access logs with administrator session activity to identify suspicious link-click patterns
Inspect stored WordPress user metadata for unauthorized changes following suspicious rf requests

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress reverse proxy or origin server
Alert on requests to donation endpoints that contain URL-encoded angle brackets or common XSS keywords
Track newly created administrator accounts and modifications to wp_options following suspected exploitation attempts

How to Mitigate CVE-2024-13728

Immediate Actions Required

Update the Accept Donations with PayPal & Stripe plugin to a version later than 1.4.4 as soon as a patched release is available
If no patched version is available, deactivate and remove the plugin from the WordPress installation
Rotate WordPress administrator credentials and force session invalidation for privileged users
Review recent administrator activity for indicators of account takeover

Patch Information

The vulnerability affects all plugin versions up to and including 1.4.4. Site administrators should monitor the plugin's WordPress.org repository and the Wordfence Vulnerability Report for a fixed release. The patch must apply proper sanitization to the rf parameter and context-appropriate escaping wherever the value is rendered.

Workarounds

Deploy a WAF rule that blocks requests containing script-like payloads in the rf parameter targeting the donation plugin path
Restrict access to WordPress administrator accounts using multi-factor authentication to reduce impact of session theft
Set a strict Content Security Policy (CSP) that disallows inline scripts on WordPress pages rendering the donation flow
Educate administrators to avoid clicking donation-related URLs from untrusted sources

bash

# Example ModSecurity rule to block XSS payloads in the rf parameter
SecRule ARGS:rf "@rx (?i)(<script|onerror=|javascript:|onload=|<svg)" \
    "id:1013728,phase:2,deny,status:403,\
    msg:'CVE-2024-13728 Reflected XSS attempt via rf parameter',\
    tag:'CWE-79'"