CVE-2024-47367: YITH WooCommerce Add-Ons XSS Flaw

CVE-2024-47367 Overview

CVE-2024-47367 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the YITH WooCommerce Product Add-Ons plugin for WordPress. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by a victim, execute arbitrary JavaScript in the victim's browser session. The vulnerability affects all plugin versions up to and including 4.13.0. Exploitation requires user interaction but no authentication, and the scope is changed, meaning the attack can affect resources beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions on the WordPress site.

Affected Products

YITH WooCommerce Product Add-Ons plugin versions through 4.13.0
WordPress sites running the affected plugin
WooCommerce stores using YITH Product Add-Ons for product customization

Discovery Timeline

2024-10-06 - CVE-2024-47367 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47367

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw in the YITH WooCommerce Product Add-Ons plugin. User-supplied input is reflected back into the response page without proper sanitization or output encoding. An attacker crafts a URL containing a malicious JavaScript payload and tricks a victim into clicking it. The browser then renders the injected script in the context of the vulnerable WordPress site.

The Exploit Prediction Scoring System (EPSS) places this issue at the 20th percentile, indicating limited observed exploitation activity. However, reflected XSS in widely-deployed WooCommerce plugins remains a common vector for phishing and account takeover campaigns.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin accepts user-controlled parameters and embeds them into HTML output without escaping special characters such as <, >, and quotation marks. This allows attacker-supplied markup to break out of the intended HTML context and execute as JavaScript.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting the vulnerable plugin endpoint with a crafted query parameter containing JavaScript. The attacker delivers this URL through phishing, social media, or malicious advertising. When an authenticated administrator or customer clicks the link, the payload executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to attacker-controlled infrastructure.

No verified proof-of-concept code is publicly available. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-47367

Indicators of Compromise

HTTP requests to YITH WooCommerce Product Add-Ons endpoints containing <script>, javascript:, or URL-encoded equivalents in query parameters
Unusual outbound requests from administrator browsers to unknown domains following clicks on suspicious links
Unexpected creation of WordPress administrator accounts or modifications to plugin settings
Web server access logs showing reflected payloads in 200 OK responses

Detection Strategies

Inspect web application firewall (WAF) logs for XSS signatures targeting the yith-woocommerce-product-add-ons plugin paths
Deploy content security policy (CSP) violation reporting to surface injected script execution
Monitor for anomalous query string lengths and encoded HTML characters on plugin endpoints

Monitoring Recommendations

Enable verbose logging on WordPress and review for suspicious parameter values reaching plugin handlers
Correlate administrator session activity with referrer URLs to identify clicks on malicious links
Alert on changes to WordPress user roles, plugin configurations, or theme files following suspicious traffic

How to Mitigate CVE-2024-47367

Immediate Actions Required

Update YITH WooCommerce Product Add-Ons to a version later than 4.13.0 that contains the patch
Audit WordPress administrator accounts and rotate credentials if exploitation is suspected
Review recent plugin and user changes for signs of unauthorized modification

Patch Information

Upgrade the plugin to a fixed release published after version 4.13.0. Consult the Patchstack Vulnerability Report for the current fixed version and vendor advisory references.

Workarounds

Deploy a WAF rule to block requests containing script tags or JavaScript event handlers in query parameters targeting the plugin
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources
Temporarily disable the YITH WooCommerce Product Add-Ons plugin until patching is completed if it is not business-critical

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads on plugin endpoints
SecRule REQUEST_URI "@contains yith-woocommerce-product-add-ons" \
    "chain,id:1004736,phase:2,deny,status:403,msg:'Blocked XSS attempt on YITH plugin'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:lowercase"