CVE-2024-47395 Overview
CVE-2024-47395 is a reflected Cross-Site Scripting (XSS) vulnerability in the Robokassa payment gateway plugin for WooCommerce. The flaw affects all plugin versions up to and including 1.6.1. The plugin fails to properly neutralize user-supplied input before reflecting it in web page output. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. The vulnerability is categorized under [CWE-79] and requires user interaction to trigger.
Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in a victim's browser, enabling session theft, credential harvesting, or redirection to malicious sites on WooCommerce stores using the Robokassa payment gateway.
Affected Products
- Robokassa payment gateway for WooCommerce plugin
- All versions from n/a through <= 1.6.1
- WordPress sites running WooCommerce with the Robokassa integration
Discovery Timeline
- 2024-10-05 - CVE-2024-47395 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47395
Vulnerability Analysis
The vulnerability is a reflected Cross-Site Scripting flaw in the Robokassa payment gateway plugin for WooCommerce. The plugin accepts input through HTTP request parameters and reflects that input into the generated HTML response without adequate sanitization or output encoding. When a victim visits a specially crafted URL, the attacker-controlled payload executes in the victim's browser under the trust context of the vulnerable WordPress site.
Reflected XSS in an e-commerce plugin is particularly consequential. Payment gateway pages typically process authenticated sessions, checkout data, and cookies that authorize purchases. An attacker who successfully injects script into a checkout flow can hijack sessions, exfiltrate sensitive form data, or manipulate DOM elements to redirect payment submissions.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses() to user-controlled parameters before echoing them into the response. This allows raw HTML and JavaScript to be interpreted by the browser.
Attack Vector
Exploitation requires an attacker to deliver a crafted URL to a target user through phishing, chat, or a malicious website. When the target clicks the link, the payload reflects into the vulnerable page and executes. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component, including other browser contexts on the same origin.
The vulnerability manifests through unsanitized request parameters processed by the plugin's page rendering logic. Refer to the Patchstack advisory for the technical breakdown of the affected parameter.
Detection Methods for CVE-2024-47395
Indicators of Compromise
- HTTP GET or POST requests to Robokassa plugin endpoints containing URL-encoded <script> tags, javascript: schemes, or event handlers such as onerror= and onload=.
- Web server access logs showing unusually long query strings or referrers pointing to attacker-controlled domains prior to checkout page hits.
- Reports from users of unexpected pop-ups, redirects, or credential prompts on WooCommerce checkout pages.
Detection Strategies
- Deploy a Web Application Firewall (WAF) with rules that identify reflected XSS payloads targeting WordPress plugin parameters.
- Enable WordPress security logging to capture all requests to Robokassa plugin URIs and inspect parameters for HTML or script content.
- Correlate outbound browser network requests with known malicious domains to identify successful exploitation attempts.
Monitoring Recommendations
- Monitor WordPress wp-content/plugins/robokassa/ directory for unexpected file changes or added handlers.
- Alert on HTTP responses that echo request parameters containing angle brackets or JavaScript keywords back to the client.
- Track Content Security Policy (CSP) violation reports to identify blocked inline script execution attempts.
How to Mitigate CVE-2024-47395
Immediate Actions Required
- Update the Robokassa payment gateway for WooCommerce plugin to a version later than 1.6.1 as soon as a patched release is available from the vendor.
- Audit WordPress plugin inventory and disable the Robokassa plugin on sites where it is not actively used for payment processing.
- Review recent WooCommerce order and checkout logs for suspicious activity that may indicate prior exploitation.
Patch Information
At the time of the CVE publication, the vulnerability affects all versions through 1.6.1. Consult the Patchstack advisory and the plugin's WordPress.org page for the latest patched version. Apply updates through the WordPress admin dashboard or WP-CLI.
Workarounds
- Deploy a WAF rule to block requests containing script tags or JavaScript event handlers directed at Robokassa plugin endpoints.
- Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources on checkout pages.
- Restrict administrative access to the WordPress backend using IP allowlisting and multi-factor authentication to limit impact of session hijacking.
# Example: Update the Robokassa plugin via WP-CLI once a patched version is available
wp plugin update robokassa --path=/var/www/html
# Example: Disable the plugin as an interim workaround
wp plugin deactivate robokassa --path=/var/www/html
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
