CVE-2024-51624: Já-Já Pagamentos WooCommerce XSS Flaw

CVE-2024-51624 Overview

CVE-2024-51624 is a reflected Cross-Site Scripting (XSS) vulnerability in the Já-Já Pagamentos for WooCommerce WordPress plugin, developed by jajapagamentos. The flaw affects all plugin versions up to and including 1.3.0. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions performed in the context of the targeted WooCommerce store.

Critical Impact
Reflected XSS in a WooCommerce payment plugin enables attackers to steal session tokens, redirect shoppers to malicious sites, or execute actions on behalf of authenticated administrators through crafted links.

Affected Products

Já-Já Pagamentos for WooCommerce plugin (wc-ja-ja-pagamentos-multicaixa-express)
All versions from n/a through 1.3.0
WordPress sites running the vulnerable plugin with WooCommerce

Discovery Timeline

2025-03-28 - CVE-2024-51624 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51624

Vulnerability Analysis

The Já-Já Pagamentos for WooCommerce plugin integrates the Multicaixa Express payment gateway into WordPress storefronts. The plugin fails to properly sanitize and encode user-controlled input before reflecting it in HTTP responses. An attacker can inject JavaScript payloads through request parameters that the plugin echoes into rendered HTML without escaping.

Reflected XSS requires user interaction. The attacker delivers a crafted URL through phishing, social engineering, or malicious referrers. When the victim loads the URL, the injected script executes within the trust boundary of the WordPress site. Because the scope is reported as changed, the impact can extend beyond the vulnerable component to other browser contexts.

Root Cause

The root cause is missing output encoding and input validation on request parameters processed by the plugin. The plugin concatenates user-supplied data directly into HTML output rather than applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). This violates secure coding practices for handling untrusted input in web page generation.

Attack Vector

Exploitation occurs over the network and requires user interaction but no privileges. The attacker constructs a URL containing a JavaScript payload as a parameter to a vulnerable plugin endpoint. The victim, typically a logged-in shopper or administrator, clicks the link. The plugin renders the payload in the response, and the browser executes the script. Consult the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2024-51624

Indicators of Compromise

Inbound HTTP requests to plugin endpoints containing <script>, javascript:, onerror=, or onload= in query parameters
URL-encoded payloads such as %3Cscript%3E or %6Aavascript targeting the wc-ja-ja-pagamentos-multicaixa-express plugin paths
Unexpected outbound requests from administrator browsers to attacker-controlled domains
WordPress session cookies appearing in external referrer logs or web beacons

Detection Strategies

Inspect web server access logs for requests to plugin URIs with suspicious query string content
Deploy a Web Application Firewall (WAF) rule that flags reflected XSS patterns targeting WooCommerce plugin endpoints
Monitor browser-side telemetry for Content Security Policy (CSP) violations on pages served by the plugin

Monitoring Recommendations

Enable WordPress audit logging to track administrator actions following suspicious link clicks
Correlate referrer headers with phishing campaign indicators to detect targeted delivery
Alert on anomalous session activity such as new user creation or plugin modifications from administrator accounts

How to Mitigate CVE-2024-51624

Immediate Actions Required

Identify all WordPress installations running the Já-Já Pagamentos for WooCommerce plugin version 1.3.0 or earlier
Update the plugin to a patched version once released by the vendor, or deactivate and remove it until a fix is available
Invalidate active administrator sessions and rotate credentials if exploitation is suspected
Apply WAF rules to block reflected XSS payloads targeting the plugin

Patch Information

At the time of publication, the vulnerability affects all versions through 1.3.0. Site operators should monitor the Patchstack WordPress Vulnerability Report for vendor patch availability and apply updates promptly.

Workarounds

Deactivate the Já-Já Pagamentos for WooCommerce plugin until a patched version is installed
Deploy a Content Security Policy (CSP) header that restricts inline script execution on WooCommerce pages
Enforce administrator access through a separate browser profile to limit session token exposure
Train staff to avoid clicking unsolicited links referencing store checkout or payment URLs

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1005124,phase:2,deny,status:403,\
    msg:'Reflected XSS attempt against ja-ja-pagamentos plugin',\
    tag:'CVE-2024-51624'"