CVE-2024-43348: Purity Of Soul Reflected XSS Vulnerability

CVE-2024-43348 Overview

CVE-2024-43348 is a reflected cross-site scripting (XSS) vulnerability affecting the Iznyn Purity Of Soul WordPress theme. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated or unauthenticated victim, execute arbitrary JavaScript in the victim's browser session. The issue affects all Purity Of Soul theme versions up to and including 1.9. Successful exploitation impacts confidentiality, integrity, and availability within the victim's browser context and can pivot into broader site compromise when the victim holds administrative privileges.

Critical Impact
Reflected XSS enables session hijacking, credential theft, and arbitrary actions performed in the context of the targeted user, including WordPress administrators.

Affected Products

Iznyn Purity Of Soul WordPress theme — versions through 1.9
WordPress sites using the vulnerable theme
All deployments where the theme is installed and activated

Discovery Timeline

2024-08-18 - CVE-2024-43348 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-43348

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Purity Of Soul theme for WordPress. User-supplied request parameters are reflected into the rendered HTML response without proper output encoding or input sanitization. An attacker who can convince a victim to visit a crafted URL — typically via phishing, malicious advertising, or a malicious referrer — can execute arbitrary JavaScript in the victim's browser. Because the vulnerability changes the security scope from the originating component to the affected document, the injected script runs with the privileges of the targeted WordPress user. The exploitation requires user interaction, which slightly raises the attacker effort, but no authentication is needed to deliver the payload.

Root Cause

The root cause is missing output encoding on theme-rendered parameters. The theme accepts request input and writes it directly into HTML contexts without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). Refer to the Patchstack Vulnerability Report for technical details.

Attack Vector

The attack is delivered over the network. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter and tricks a victim into clicking it. When the victim's browser renders the response, the injected script executes within the site's origin. Common outcomes include exfiltration of session cookies, forced administrative actions through forged requests, redirection to attacker-controlled infrastructure, and injection of additional malicious payloads such as backdoored plugins or theme files.

// No verified public exploit code available. See the Patchstack advisory for technical details.

Detection Methods for CVE-2024-43348

Indicators of Compromise

HTTP request logs containing reflected payloads with <script>, javascript:, onerror=, or onload= substrings in query parameters
Outbound browser requests to unfamiliar domains immediately following a click on a WordPress page that loaded the Purity Of Soul theme
Creation of unexpected administrator accounts or modification of theme and plugin files in WordPress
Anomalous session cookie transmissions to non-site origins

Detection Strategies

Inspect web server access logs for encoded XSS payloads such as %3Cscript%3E, %22%3E, and javascript%3A in request URIs
Deploy a web application firewall with OWASP CRS rules covering reflected XSS patterns
Use static analysis on the theme codebase to flag direct echoing of $_GET, $_POST, or $_REQUEST values

Monitoring Recommendations

Forward WordPress and reverse proxy logs to a centralized SIEM and alert on XSS signature matches
Monitor for unexpected JavaScript execution and DOM modifications using browser-based content security policy violation reports
Track changes to WordPress administrator accounts, theme files, and plugin installations

How to Mitigate CVE-2024-43348

Immediate Actions Required

Deactivate and remove the Purity Of Soul theme until a patched release is confirmed available
Switch the site to a maintained, security-reviewed WordPress theme
Force a password reset for all WordPress administrators and rotate session tokens
Apply a web application firewall rule blocking XSS payloads targeting theme parameters

Patch Information

At the time of NVD publication, no fixed version beyond 1.9 is referenced in the available data. Site operators should consult the Patchstack Vulnerability Report for the latest remediation guidance and confirm the theme vendor's status before reinstalling.

Workarounds

Remove the vulnerable theme and replace it with a supported alternative
Implement a strict Content Security Policy (CSP) that disallows inline scripts and unknown script sources
Enforce HttpOnly and Secure attributes on WordPress session cookies to limit cookie theft impact
Restrict administrator access by IP allowlist where operationally feasible

bash

# Example nginx Content-Security-Policy header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;