CVE-2024-43975 Overview
CVE-2024-43975 is a Cross-Site Scripting (XSS) vulnerability in the Super Store Finder WordPress plugin developed by highwarden. The flaw affects all plugin versions up to and including 6.9.7. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An attacker can inject malicious scripts that execute in the context of a victim's browser session when the victim interacts with a crafted link or page.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions within the WordPress site.
Affected Products
- Super Store Finder for WordPress (superstorefinder-wp) versions up to and including 6.9.7
- WordPress installations with the vulnerable plugin active
- Any site serving pages generated by the plugin to end users
Discovery Timeline
- 2024-09-18 - CVE CVE-2024-43975 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43975
Vulnerability Analysis
The Super Store Finder plugin fails to sanitize or encode user-controlled input before rendering it into HTML output. This classic reflected XSS condition allows an attacker to craft a URL containing JavaScript payloads that the plugin reflects back into the page. When a logged-in user or site visitor clicks the crafted link, the browser executes the attacker's script in the site's security context.
The scope-changed attack surface indicates the script executes beyond the plugin's own boundary, affecting the broader WordPress session. User interaction is required for exploitation, typically through social engineering or a phishing lure. The vulnerability carries low privilege requirements, meaning unauthenticated attackers can deliver the payload.
Root Cause
The root cause is improper neutralization of input during web page generation. The plugin accepts request parameters and inserts them into HTML responses without applying contextual output encoding or input validation. WordPress provides sanitization helpers such as esc_html(), esc_attr(), and wp_kses(), which were not consistently applied to the vulnerable code paths.
Attack Vector
Exploitation occurs over the network through a crafted HTTP request. The attacker distributes a URL pointing to a vulnerable endpoint on a target WordPress site. When a victim visits the link, the plugin reflects the malicious parameter into the page, and the browser executes the embedded JavaScript. See the Patchstack Security Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-43975
Indicators of Compromise
- Web server access logs containing requests to Super Store Finder endpoints with <script>, javascript:, onerror=, or encoded script payloads in query parameters
- Unexpected outbound requests from browser sessions after visiting pages served by the plugin
- WordPress administrator accounts exhibiting unauthorized configuration changes or new user creation following link clicks
Detection Strategies
- Inspect HTTP request parameters sent to plugin URLs for script tags, event handlers, and URL-encoded JavaScript constructs
- Deploy a Web Application Firewall (WAF) rule set that identifies reflected XSS patterns targeting WordPress plugin parameters
- Review browser Content Security Policy (CSP) violation reports for scripts loaded from unexpected origins on pages that embed the plugin
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward access logs to a central analytics platform for query parameter analysis
- Monitor for anomalous session activity, such as administrator sessions originating from unusual IP addresses shortly after link engagement
- Track plugin version inventory across managed WordPress sites and alert when superstorefinder-wp versions <= 6.9.7 are detected
How to Mitigate CVE-2024-43975
Immediate Actions Required
- Identify all WordPress installations running Super Store Finder and determine the installed version
- Update the plugin to a version released after 6.9.7 that addresses the XSS flaw, if available from the vendor
- Restrict administrator access to trusted networks and enforce multi-factor authentication to limit the impact of session compromise
Patch Information
At the time of CVE publication, the vulnerability affects Super Store Finder versions up to and including 6.9.7. Site operators should consult the Patchstack Security Vulnerability Report and the plugin vendor's channels for the latest patched release.
Workarounds
- Deactivate and remove the Super Store Finder plugin until a patched version is installed
- Deploy a WAF with reflected XSS rules protecting WordPress query parameters, including virtual patching rules provided by Patchstack or similar services
- Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources to reduce exploitability
# Example: identify vulnerable plugin installations via WP-CLI
wp plugin list --name=superstorefinder-wp --fields=name,status,version
# Deactivate the plugin as a temporary workaround
wp plugin deactivate superstorefinder-wp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
