CVE-2024-49283: CURCY Multi-Currency XSS Vulnerability

CVE-2024-49283 Overview

CVE-2024-49283 is a reflected Cross-Site Scripting (XSS) vulnerability in the VillaTheme CURCY (Woo Multi-Currency) plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability affects all CURCY plugin versions up to and including 2.2.3. Exploitation requires user interaction but no authentication, and impacts confidentiality, integrity, and availability with a scope change to the browser context.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions performed against the WooCommerce store.

Affected Products

VillaTheme CURCY (Woo Multi-Currency) plugin for WordPress
All versions from n/a through 2.2.3
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2024-10-17 - CVE-2024-49283 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-49283

Vulnerability Analysis

The CURCY plugin fails to properly sanitize and encode user-controlled input before reflecting it back into HTTP responses. When a request parameter is echoed into the rendered page without contextual output encoding, browser-side JavaScript executes within the origin of the vulnerable WordPress site. The reflected XSS pattern enables attackers to deliver payloads through phishing links, malicious advertising, or compromised referrers. Because the vulnerability operates at the browser layer with a scope change, payloads can affect resources beyond the vulnerable component, including the WordPress admin context if an authenticated administrator clicks the crafted link.

Root Cause

The root cause is missing or insufficient input neutralization on parameters processed by the CURCY plugin. The plugin reflects attacker-controlled values into HTML, attribute, or JavaScript contexts without applying functions such as esc_html(), esc_attr(), or wp_kses() from the WordPress API. This violates secure output handling and maps directly to [CWE-79].

Attack Vector

The attack vector is network-based with low attack complexity and no privileges required, but user interaction is mandatory. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter handled by the CURCY plugin. The attacker delivers the URL via email, social media, or malicious referrer. When the victim visits the URL on the targeted WordPress site, the payload executes in the victim's browser, allowing the attacker to read cookies, steal session tokens, or perform actions on behalf of the victim. The vulnerability mechanism is documented in the Patchstack Woo Multi-Currency XSS Vulnerability advisory.

Detection Methods for CVE-2024-49283

Indicators of Compromise

HTTP requests to CURCY plugin endpoints containing URL-encoded <script>, onerror=, or javascript: payloads in query parameters
Web server access logs showing unusual referrers paired with reflected parameter values containing HTML or JavaScript syntax
WordPress administrator sessions exhibiting unexpected actions such as user creation, plugin installation, or settings changes shortly after clicking external links

Detection Strategies

Inspect WordPress access logs for suspicious query strings targeting CURCY plugin paths, focusing on parameter values containing angle brackets, event handler attributes, or encoded script tags
Deploy a Web Application Firewall (WAF) with rules tuned to identify reflected XSS patterns in WooCommerce plugin parameters
Run plugin inventory scans to identify WordPress sites running CURCY versions at or below 2.2.3

Monitoring Recommendations

Forward WordPress, web server, and WAF telemetry to a centralized SIEM for correlation of suspicious request patterns and administrator session anomalies
Monitor browser-side Content Security Policy (CSP) violation reports to surface attempted script injection in real time
Track outbound requests from WordPress hosts to attacker-controlled domains that may indicate exfiltration through injected scripts

How to Mitigate CVE-2024-49283

Immediate Actions Required

Update the VillaTheme CURCY plugin to a version later than 2.2.3 as soon as a patched release is available from the vendor
Audit WordPress administrator accounts for unauthorized changes, new users, and modified plugin or theme files
Invalidate active sessions and rotate credentials for any administrator who may have clicked suspicious URLs targeting the site

Patch Information

Review the Patchstack advisory for the CURCY plugin for the current fixed version and apply the update through the WordPress plugin manager. Confirm the installed version is above 2.2.3 after patching.

Workarounds

Deactivate and remove the CURCY plugin until a patched version is installed if multi-currency functionality is non-essential
Deploy a WAF rule set such as Patchstack or equivalent virtual patching to block reflected XSS payloads targeting the vulnerable parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example Content-Security-Policy header to reduce reflected XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"