CVE-2024-29130: Contact Form 7 PayPal Stripe Add-on XSS

CVE-2024-29130 Overview

CVE-2024-29130 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress. The flaw affects all versions of the plugin up to and including 2.0. It stems from improper neutralization of user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in a victim's browser.

Exploitation requires user interaction, typically by tricking a target into clicking a crafted URL. Successful attacks can lead to session hijacking, credential theft, or unauthorized actions performed in the context of the victim's WordPress session.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling account compromise, cookie theft, and redirection to attacker-controlled infrastructure.

Affected Products

Scott Paterson Contact Form 7 – PayPal & Stripe Add-on for WordPress
All versions from initial release through 2.0
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-03-19 - CVE-2024-29130 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29130

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Contact Form 7 – PayPal & Stripe Add-on plugin. The plugin accepts input parameters that are echoed back into the rendered HTML response without adequate sanitization or output encoding. When user-controlled data reaches the response body unescaped, an attacker can inject HTML and JavaScript payloads.

Because the flaw is reflected rather than stored, exploitation depends on delivering a crafted link to a victim. The scope change indicated by the CVSS vector suggests that the injected script can affect resources beyond the vulnerable component, such as the WordPress administrative interface or other browser-origin data.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Request parameters processed by plugin handlers are inserted into HTML output without functions such as esc_html(), esc_attr(), or wp_kses() applied to strip or encode dangerous characters. This allows characters such as <, >, and quotes to break out of intended contexts.

Attack Vector

Exploitation proceeds over the network and requires the victim to interact with an attacker-supplied resource, typically a phishing link. The attacker crafts a URL targeting a vulnerable endpoint of the plugin with a malicious payload embedded in a query parameter. When the victim's browser loads the response, the payload executes in the context of the WordPress site.

Refer to the Patchstack XSS Vulnerability Report for additional technical detail on the affected parameter and payload behavior.

Detection Methods for CVE-2024-29130

Indicators of Compromise

Web server access logs containing requests to plugin endpoints with <script>, onerror=, javascript:, or URL-encoded equivalents in query parameters
Unexpected outbound connections from administrator browsers to unknown domains shortly after clicking external links
New or modified WordPress administrator accounts created without authorization
Session cookies appearing in referer headers or third-party analytics logs

Detection Strategies

Inspect HTTP request logs for reflected input patterns targeting the Contact Form 7 – PayPal & Stripe Add-on parameters
Deploy a web application firewall (WAF) rule set that flags common XSS payloads such as <script>, onload=, and encoded angle brackets
Monitor WordPress audit logs for unusual administrative activity following inbound clicks from external referrers

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for correlation
Track plugin version inventory across managed WordPress hosts and alert when versions at or below 2.0 are present
Configure browser Content Security Policy (CSP) reporting endpoints to capture blocked inline script attempts

How to Mitigate CVE-2024-29130

Immediate Actions Required

Deactivate the Contact Form 7 – PayPal & Stripe Add-on plugin on all affected WordPress sites until a patched version is confirmed
Review WordPress administrator accounts and rotate session tokens and passwords for any account that may have interacted with a suspicious link
Apply WAF rules that block common reflected XSS payloads targeting plugin endpoints

Patch Information

At the time of the NVD entry, the vulnerability affects all versions through 2.0. Consult the Patchstack XSS Vulnerability Report for the latest vendor guidance and any released fixed version. If no patch is available, remove the plugin.

Workarounds

Uninstall the plugin and replace it with a maintained alternative for Contact Form 7 payment integrations
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Require administrators to use dedicated browsers or profiles for WordPress administration to limit the blast radius of a successful XSS

bash

# Example WordPress CLI command to deactivate and remove the vulnerable plugin
wp plugin deactivate contact-form-7-paypal-add-on
wp plugin uninstall contact-form-7-paypal-add-on