CVE-2024-13827 Overview
CVE-2024-13827 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Razorpay Subscription Button Elementor Plugin for WordPress. The flaw affects all versions up to and including 1.0.3. It stems from unsafe use of the add_query_arg() and remove_query_arg() WordPress functions without proper URL escaping. Unauthenticated attackers can inject arbitrary web scripts into pages, which execute when a victim clicks a crafted link. The issue is tracked as CWE-79.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or forced administrative actions in the WordPress context.
Affected Products
- Razorpay Subscription Button Elementor Plugin for WordPress (all versions up to and including 1.0.3)
- WordPress sites using the vulnerable plugin with the rzp-payment-buttons.php component
- Elementor-based WordPress installations that integrate the Razorpay subscription button
Discovery Timeline
- 2025-03-05 - CVE-2024-13827 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13827
Vulnerability Analysis
The vulnerability resides in the plugin's handling of URL query parameters. Specifically, rzp-payment-buttons.php uses the WordPress helper functions add_query_arg() and remove_query_arg() to construct URLs that are subsequently reflected into the HTML response. These functions do not automatically encode or escape user-supplied input. When an attacker controls a request parameter that ends up passed to these helpers, the raw value is embedded into the page output.
Because the vulnerable code path is reachable without authentication, any visitor to the affected page can trigger the flaw. Successful exploitation requires user interaction, typically clicking a maliciously crafted link. Once executed, attacker-controlled JavaScript runs in the origin of the target WordPress site.
Root Cause
The root cause is missing output encoding on values returned from add_query_arg() and remove_query_arg(). WordPress documentation explicitly warns that these functions do not sanitize input and that developers must apply esc_url() or an equivalent escaping routine before echoing the resulting URL. The plugin omits this step in the affected code path, allowing HTML and script content to break out of URL attribute contexts.
Attack Vector
An attacker crafts a URL to a page on the vulnerable WordPress site containing a malicious query parameter. The attacker delivers the URL through phishing email, social media, or a hostile third-party site. When a logged-in administrator or general site visitor follows the link, the injected payload is reflected into the rendered HTML and executed by the browser. The attacker can then perform session hijacking, redirect the victim, or invoke administrative functions using the victim's privileges.
Refer to the WordPress Plugin Code Fragment and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2024-13827
Indicators of Compromise
- Web server access logs containing requests to pages rendered by the Razorpay Subscription Button plugin with query parameters holding <script>, javascript:, onerror=, or URL-encoded equivalents.
- Referrer headers pointing to unknown external domains preceding requests to plugin-serviced endpoints.
- Browser console errors or unexpected outbound requests from administrator sessions after clicking third-party links.
Detection Strategies
- Inspect HTTP request logs for anomalous query strings on URLs that load the plugin's payment button pages.
- Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS payloads in query parameters directed at WordPress endpoints.
- Enable a strict Content Security Policy (CSP) and monitor CSP violation reports for inline-script violations originating from plugin pages.
Monitoring Recommendations
- Track installed plugin versions across WordPress fleets and alert when the Razorpay Subscription Button Elementor Plugin is present at version 1.0.3 or lower.
- Monitor administrator account activity for unexpected profile changes, new user creation, or content modifications shortly after link-click events.
- Correlate email gateway telemetry with WordPress access logs to identify phishing campaigns targeting site administrators.
How to Mitigate CVE-2024-13827
Immediate Actions Required
- Update the Razorpay Subscription Button Elementor Plugin to a version later than 1.0.3, as tracked in the WordPress Change Set Update.
- If a patched version is unavailable for your environment, deactivate and remove the plugin until a fix can be applied.
- Force session invalidation for administrator accounts and rotate credentials if suspicious link-click activity is observed.
Patch Information
The plugin author committed a fix in the trunk changeset referenced above. Site administrators should install the latest release from the WordPress Plugin Developer Page and verify the installed version reports higher than 1.0.3.
Workarounds
- Deploy a WAF signature that blocks requests containing script tags, event handlers, or javascript: schemes in query parameters routed to the plugin.
- Restrict administrator access to the WordPress dashboard by IP allowlist to reduce the exploitable audience.
- Enforce a Content Security Policy that disallows inline scripts and untrusted external script sources on the affected site.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.