CVE-2024-35680: YITH WooCommerce Product Add-Ons XSS Flaw

CVE-2024-35680 Overview

CVE-2024-35680 is a Basic Cross-Site Scripting (XSS) vulnerability in the YITH WooCommerce Product Add-Ons plugin for WordPress. The flaw stems from improper neutralization of script-related HTML tags in a web page, tracked as [CWE-80]. All plugin versions up to and including 4.9.2 are affected. An unauthenticated attacker can inject content that leads to script execution in the context of a victim's browser session. The issue is network-exploitable without user interaction and impacts content integrity on affected WooCommerce storefronts.

Critical Impact
Unauthenticated attackers can inject unsanitized script-related HTML into pages served by the YITH WooCommerce Product Add-Ons plugin, enabling content injection against store visitors and administrators.

Affected Products

YITH WooCommerce Product Add-Ons (yith-woocommerce-product-add-ons) versions up to and including 4.9.2
WordPress sites running the free edition of the plugin with WooCommerce enabled
E-commerce environments exposing plugin-rendered product pages to public traffic

Discovery Timeline

2024-06-10 - CVE-2024-35680 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35680

Vulnerability Analysis

The vulnerability is a Basic XSS issue rooted in improper neutralization of script-related HTML tags before content is rendered in a web page. The plugin fails to strip or encode <script>-style constructs supplied through user-controllable input, allowing injected markup to reach the rendered DOM. Because the attack vector is network-based and does not require authentication or user interaction, an attacker can deliver payloads through publicly accessible request paths handled by the plugin. Exploitation primarily affects integrity, enabling content injection and defacement-style manipulation of affected pages. Successful injection can also be chained with social engineering to steal session tokens, redirect visitors, or manipulate checkout flows on WooCommerce stores.

Root Cause

The root cause is missing or insufficient output sanitization of script-related HTML tags in code paths exposed by the yith-woocommerce-product-add-ons plugin through version 4.9.2. Input containing tags such as <script> is not filtered through WordPress escaping functions like esc_html(), wp_kses(), or esc_attr() before rendering. This maps to CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Attack Vector

An unauthenticated remote attacker submits crafted input containing HTML markup to a plugin endpoint or field that is later reflected or stored and rendered on a page served by the WordPress site. When a visitor or administrator loads the affected page, the browser parses and executes the injected markup. See the Patchstack Vulnerability Report for details on the affected input handling.

Detection Methods for CVE-2024-35680

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes appearing in stored WooCommerce product add-on fields or option values.
Web server access logs showing POST or GET requests to plugin endpoints containing URL-encoded %3Cscript%3E or similar payloads.
Outbound requests from client browsers to unknown domains after loading pages that render plugin content.
WordPress option or postmeta rows containing HTML markup where only plain text is expected.

Detection Strategies

Query the WordPress database for postmeta and options entries related to the plugin and flag any values containing <script, onerror=, or javascript: substrings.
Deploy a Web Application Firewall (WAF) rule matching XSS payloads against plugin URIs and monitor triggered signatures.
Compare installed plugin version against 4.9.2; any version at or below indicates exposure until patched.

Monitoring Recommendations

Enable file integrity monitoring across the wp-content/plugins/yith-woocommerce-product-add-ons/ directory.
Forward WordPress and web server access logs to a centralized analytics platform for XSS pattern detection.
Alert on administrator sessions loading pages that contain unexpected inline <script> blocks originating from plugin-managed content.

How to Mitigate CVE-2024-35680

Immediate Actions Required

Update YITH WooCommerce Product Add-Ons to a version later than 4.9.2 as soon as the vendor releases a fixed release.
Audit stored product add-on data for injected HTML and remove any unauthorized markup before restoring pages.
Rotate WordPress administrator credentials if injected payloads may have executed in an authenticated session.
Enable a WAF with XSS filtering rules in front of the WordPress site.

Patch Information

Refer to the Patchstack CVE Analysis for the current fixed version and vendor advisory. Verify the plugin release notes before upgrading production stores, and stage the update in a non-production environment first.

Workarounds

Temporarily disable the yith-woocommerce-product-add-ons plugin until a patched version is applied.
Restrict access to plugin administrative pages using web server IP allow-listing.
Apply WAF virtual patching rules that block requests containing script tags targeting plugin endpoints.

bash

# Example WAF-style ModSecurity rule to block script tags on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/yith-woocommerce-product-add-ons/" \
  "chain,id:1003580,phase:2,deny,status:403,log,msg:'Block XSS payload targeting CVE-2024-35680'"
  SecRule ARGS "@rx (?i)<\s*script|onerror\s*=|javascript:" "t:none,t:urlDecodeUni"