CVE-2024-35766 Overview
CVE-2024-35766 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the ollybach WPPizza plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, allowing attackers to inject arbitrary scripts into responses rendered by the plugin. All versions of WPPizza up to and including 3.18.13 are affected. Exploitation requires a victim to interact with a crafted link, at which point the injected payload executes in the victim's browser under the site's origin. The issue is tracked as [CWE-79] and impacts confidentiality and integrity of user sessions interacting with vulnerable WordPress sites.
Critical Impact
A successful attack can hijack authenticated sessions, deliver phishing content, or redirect users to attacker-controlled infrastructure through a single crafted URL.
Affected Products
- ollybach WPPizza (WordPress restaurant plugin)
- WPPizza versions from n/a through 3.18.13
- WordPress sites running the vulnerable plugin build
Discovery Timeline
- 2024-06-21 - CVE-2024-35766 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35766
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the WPPizza plugin. User-controlled input reaches an HTML response context without sufficient encoding or sanitization. When a victim visits a crafted URL, the injected payload is reflected back and executed in the browser under the WordPress site's origin.
Because the flaw requires user interaction and executes in the browser, the practical impact centers on session theft, credential harvesting, and unauthorized actions performed on behalf of authenticated users. Administrators who click a crafted link can expose privileged session tokens, which can extend the impact to full site compromise via plugin or theme modification.
The scope change indicated by the CVSS vector reflects that the payload executes in the browser context, affecting resources beyond the vulnerable component itself.
Root Cause
The root cause is missing or incomplete output encoding on a request parameter handled by WPPizza. The plugin echoes attacker-controlled input into an HTML response without escaping characters such as <, >, and ". This allows arbitrary JavaScript to break out of the intended data context and execute within the DOM.
Attack Vector
An attacker crafts a URL containing a malicious script payload targeting the vulnerable WPPizza endpoint. The attacker then delivers the URL through phishing email, social media, or a malicious referrer. When the victim loads the URL in an authenticated browser session, the reflected payload executes with the privileges of the visiting user.
Refer to the Patchstack WPPizza XSS Vulnerability advisory for the specific parameter and reproduction details.
Detection Methods for CVE-2024-35766
Indicators of Compromise
- Web server access logs containing WPPizza request parameters with <script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
- Outbound requests from browsers to unfamiliar domains immediately after users visit WPPizza plugin URLs.
- Unexpected administrator account creations or plugin modifications shortly after suspicious inbound requests.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects query strings for reflected XSS payload patterns targeting WPPizza endpoints.
- Correlate WordPress wp-admin privileged actions with preceding requests containing script-like characters in query parameters.
- Alert on responses from WPPizza URLs that contain reflected request parameters within <script> tags or HTML event handlers.
Monitoring Recommendations
- Enable verbose access logging on all WordPress instances running WPPizza and forward logs to a centralized analytics platform.
- Monitor browser Content Security Policy (CSP) violation reports for the affected site to identify script execution attempts.
- Track the installed WPPizza version across your estate and alert when any host runs a version at or below 3.18.13.
How to Mitigate CVE-2024-35766
Immediate Actions Required
- Update WPPizza to a release beyond 3.18.13 on all WordPress instances immediately.
- Audit administrator accounts and reset credentials for any user who may have interacted with suspicious links.
- Rotate WordPress authentication keys and salts in wp-config.php to invalidate potentially stolen sessions.
Patch Information
The vendor addressed the reflected XSS in a WPPizza release later than 3.18.13. Consult the Patchstack WPPizza XSS Vulnerability advisory for the fixed version and upgrade guidance. Apply the patched release through the WordPress plugin manager or by replacing plugin files directly.
Workarounds
- Deactivate the WPPizza plugin until a patched version is installed if immediate upgrade is not possible.
- Deploy a WAF rule blocking requests to WPPizza endpoints that contain HTML tag characters or common XSS payload keywords in parameters.
- Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of any reflected payload.
# Example WordPress CLI upgrade for WPPizza
wp plugin update wppizza --path=/var/www/html
wp plugin list --name=wppizza --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
