CVE-2024-35730: Active Products Tables for WooCommerce XSS

CVE-2024-35730 Overview

CVE-2024-35730 is a reflected Cross-Site Scripting (XSS) vulnerability in the realmag777 Active Products Tables for WooCommerce plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All plugin versions up to and including 1.0.6.3 are affected. An unauthenticated attacker can craft a malicious URL that, when visited by a victim, executes attacker-controlled JavaScript in the victim's browser session. The vulnerability was published to the National Vulnerability Database (NVD) on June 8, 2024.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and administrative actions if the victim is a logged-in WordPress administrator.

Affected Products

Active Products Tables for WooCommerce (plugin slug: profit-products-tables-for-woocommerce)
All versions from n/a through 1.0.6.3
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2024-06-08 - CVE-2024-35730 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35730

Vulnerability Analysis

The vulnerability is a reflected XSS flaw classified under [CWE-79]. The Active Products Tables for WooCommerce plugin accepts input parameters and reflects them back into rendered HTML without proper sanitization or output encoding. An attacker crafts a URL containing a malicious payload, then delivers that URL to a victim through phishing, social engineering, or a malicious link. When the victim's browser loads the page, the injected script executes in the site's origin.

Exploitation requires user interaction, and the scope changes when the payload executes. This means the injected script can affect resources beyond the vulnerable component, including the victim's WordPress session cookies and any authenticated actions available to that user.

Root Cause

The root cause is missing input validation and output encoding on request parameters processed by the plugin. The plugin echoes attacker-controlled data into HTML responses without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). This allows arbitrary HTML and JavaScript to be inserted into the response body.

Attack Vector

The attack is delivered over the network and requires no authentication. A typical exploitation flow involves the attacker crafting a URL to a vulnerable endpoint of the plugin, embedding a JavaScript payload in a reflected parameter, and sending that link to a target. When the victim clicks the link on the affected WordPress site, the payload executes in the site context. If the victim is an authenticated administrator, the attacker can perform actions such as creating new admin accounts, modifying plugin settings, or exfiltrating session tokens.

No public proof-of-concept exploit code has been published for this vulnerability. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-35730

Indicators of Compromise

Web server access logs containing requests to Active Products Tables plugin endpoints with URL-encoded <script>, javascript:, or onerror= payloads in query parameters
Unexpected creation of new WordPress administrator accounts following visits to plugin URLs
Outbound requests from browser sessions to attacker-controlled domains after loading plugin pages
Referer headers pointing to external phishing pages that redirect users to the WordPress site

Detection Strategies

Inspect HTTP request parameters for reflected XSS payloads, including HTML tags, event handlers, and encoded script fragments
Deploy a Web Application Firewall (WAF) with rules that block common XSS signatures on WordPress endpoints
Enable WordPress audit logging to capture administrator account changes, plugin modifications, and user session anomalies

Monitoring Recommendations

Monitor plugin URLs and query strings for anomalous parameter content and unusual request volumes
Alert on new WordPress user accounts created with administrator privileges outside change-management windows
Track browser-based telemetry for unexpected script execution or cross-origin requests originating from WordPress pages

How to Mitigate CVE-2024-35730

Immediate Actions Required

Inventory all WordPress installations and identify sites running Active Products Tables for WooCommerce version 1.0.6.3 or earlier
Update the plugin to the latest patched version available from the WordPress plugin repository or the vendor
If a patch is not immediately available, deactivate and remove the plugin until a fix is applied
Force password resets for all WordPress administrator accounts on affected sites

Patch Information

The vendor should release a version above 1.0.6.3 that applies proper input validation and output encoding. Review the Patchstack advisory for the fixed version and vendor guidance.

Workarounds

Deploy WAF rules blocking XSS payloads in HTTP requests to WordPress endpoints associated with the plugin
Configure a strict Content Security Policy (CSP) header restricting inline scripts and untrusted script sources
Restrict administrative WordPress access to trusted IP ranges through server-level access controls
Educate administrators to avoid clicking untrusted links while authenticated to the WordPress admin panel

bash

# Example nginx configuration to add Content-Security-Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;