CVE-2024-35733: Auto Coupons for WooCommerce XSS Vulnerability

CVE-2024-35733 Overview

CVE-2024-35733 is a reflected Cross-Site Scripting (XSS) vulnerability in the RLDD Auto Coupons for WooCommerce WordPress plugin. The flaw affects all plugin versions up to and including 3.0.14. Attackers can inject malicious JavaScript through unsanitized input that the plugin reflects back into rendered web pages. Exploitation requires a victim to click a crafted link, after which the injected script executes in the victim's browser session. The vulnerability is tracked under [CWE-79] and can lead to session theft, credential harvesting, or unauthorized actions on the WooCommerce store.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, potentially hijacking authenticated WordPress administrator sessions and pivoting into full site compromise.

Affected Products

RLDD Auto Coupons for WooCommerce plugin versions up to and including 3.0.14
WordPress sites running WooCommerce with the affected plugin installed
All WordPress deployments where the plugin remains unpatched

Discovery Timeline

2024-06-08 - CVE-2024-35733 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35733

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The Auto Coupons for WooCommerce plugin accepts input parameters and reflects them into HTTP responses without adequate sanitization or output encoding. An attacker crafts a URL containing JavaScript payloads in vulnerable request parameters. When a victim clicks the link, the plugin returns a page containing the attacker's script, which then executes in the victim's browser under the origin of the WordPress site.

The scope change reflected in the CVSS vector indicates that the injected script can affect resources beyond the vulnerable component, such as other authenticated sessions on the WordPress site.

Root Cause

The root cause is missing input validation and output encoding within the plugin's request-handling logic. User-controlled data flows directly into HTML output without HTML entity encoding or context-aware escaping. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output rendering, but the affected code paths in versions through 3.0.14 do not apply them consistently.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a malicious URL pointing to the vulnerable WordPress endpoint with an XSS payload in a query parameter. The attacker delivers this link via phishing email, social media, or a compromised third-party site. When a WordPress administrator or logged-in user clicks the link, the reflected script executes with the privileges of that user session, enabling actions such as creating rogue administrator accounts or exfiltrating session cookies.

No verified exploitation code is publicly available. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-35733

Indicators of Compromise

Web server access logs containing HTTP requests with encoded <script>, javascript:, or onerror= payloads targeting plugin endpoints
Unexpected creation of new WordPress administrator accounts following requests to Auto Coupons plugin URLs
Outbound requests from browsers to attacker-controlled domains immediately after visiting WooCommerce coupon pages
Referrer headers from phishing domains linking directly to plugin endpoints with suspicious query strings

Detection Strategies

Deploy a Web Application Firewall (WAF) with rules that inspect query parameters and request bodies for XSS payload patterns
Enable and review WordPress security plugin logs for anomalous parameter values sent to /wp-content/plugins/woo-auto-coupons/ paths
Correlate reflected response bodies against inbound request parameters to identify unsanitized echo patterns

Monitoring Recommendations

Monitor WordPress user activity logs for administrator role assignments, plugin installations, and setting changes
Alert on browser console errors or Content Security Policy (CSP) violations reported by browsers loading plugin pages
Track HTTP response codes and payload sizes on plugin endpoints to identify anomalous reflection patterns

How to Mitigate CVE-2024-35733

Immediate Actions Required

Update the RLDD Auto Coupons for WooCommerce plugin to a version later than 3.0.14 as soon as a patched release is available from the vendor
Audit WordPress administrator accounts for unauthorized additions or privilege changes
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected
Review installed plugins and remove Auto Coupons for WooCommerce if a patched version is unavailable and the feature is non-essential

Patch Information

Refer to the Patchstack advisory for CVE-2024-35733 for the latest patch status. The advisory tracks affected versions through 3.0.14. Administrators should verify the installed version via the WordPress admin dashboard and apply any vendor update immediately upon release.

Workarounds

Deploy a WAF ruleset that blocks reflected XSS payload patterns targeting the plugin's request parameters
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Restrict WordPress administrator access to trusted IP ranges via .htaccess or reverse proxy rules to reduce phishing exposure
Disable the Auto Coupons for WooCommerce plugin until a patched version is confirmed

bash

# Example nginx rule to block common reflected XSS payloads on the plugin path
location ~* /wp-content/plugins/woo-auto-coupons/ {
    if ($args ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
        return 403;
    }
}