CVE-2024-51784: FriendStore for WooCommerce XSS Flaw

CVE-2024-51784 Overview

CVE-2024-51784 is a reflected Cross-Site Scripting (XSS) vulnerability in the VietFriend team FriendStore for WooCommerce WordPress plugin. The flaw affects all plugin versions from initial release through 1.4.2. The vulnerability stems from improper neutralization of user input during web page generation, classified under [CWE-79].

Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the victim clicks the link. Successful exploitation requires user interaction but no authentication, and the scope change allows the attack to impact resources beyond the vulnerable component.

Critical Impact

Reflected XSS enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated WooCommerce users, including administrators.

Affected Products

• VietFriend team FriendStore for WooCommerce plugin
• All versions through 1.4.2
• WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

• 2024-11-09 - CVE-2024-51784 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51784

Vulnerability Analysis

The vulnerability is a reflected XSS flaw [CWE-79] in the friendstore-for-woocommerce plugin. The plugin reflects user-controlled input back into HTTP responses without proper output encoding or input sanitization. An attacker supplies crafted payloads through URL parameters that the plugin renders directly into the resulting HTML page.

When a victim follows a malicious link, the injected JavaScript executes in the browser under the trust context of the WordPress site. Because the CVSS vector indicates a scope change, the executed script can affect resources outside the vulnerable plugin, including the broader WordPress session and authenticated WooCommerce functionality.

The EPSS score of 0.259% places this vulnerability in the 17th percentile for exploitation likelihood. While no public exploit is currently catalogued, reflected XSS in e-commerce plugins remains attractive to phishing and account takeover campaigns.

Root Cause

The root cause is the absence of context-aware output escaping on parameters the plugin echoes back to users. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() to neutralize HTML and script content, but the plugin fails to apply these consistently before rendering reflected input.

Attack Vector

The attack vector is network-based and requires victim interaction. An attacker constructs a URL targeting a vulnerable endpoint of the plugin, embeds a JavaScript payload in a reflected parameter, and delivers the link through phishing, forum posts, or compromised referrers. When the victim loads the URL on the affected WordPress site, the payload executes in their browser session.

See the Patchstack WordPress Plugin Advisory for additional technical details.

Detection Methods for CVE-2024-51784

Indicators of Compromise

• HTTP request logs containing <script>, javascript:, onerror=, or onload= substrings in query parameters targeting plugin endpoints
• URL-encoded payloads such as %3Cscript%3E or %3Cimg directed at friendstore-for-woocommerce paths
• Unusual referrer headers pointing to external phishing infrastructure preceding administrative actions
• Browser console errors or unexpected outbound requests from WooCommerce admin sessions

Detection Strategies

• Inspect web server access logs for suspicious query strings on URLs containing friendstore-for-woocommerce
• Deploy a Web Application Firewall (WAF) ruleset that flags reflected XSS patterns in WordPress plugin requests
• Correlate phishing email telemetry with subsequent visits to the WordPress site from targeted administrator accounts

Monitoring Recommendations

• Enable verbose access logging on the WordPress front-end and forward logs to a centralized SIEM for analysis
• Monitor authenticated administrator sessions for anomalous actions immediately following external link clicks
• Track new or modified WordPress user accounts and plugin installations that may indicate post-exploitation activity

How to Mitigate CVE-2024-51784

Immediate Actions Required

• Identify all WordPress sites running the FriendStore for WooCommerce plugin at version 1.4.2 or earlier
• Disable or remove the plugin until a patched version is available and verified
• Force re-authentication for administrator accounts and rotate WordPress session keys via wp-config.php salts
• Educate administrators to avoid clicking unsolicited links to the WooCommerce store while authenticated

Patch Information

As of the latest NVD update, the vendor advisory listed on Patchstack confirms the vulnerability affects versions through 1.4.2. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release and apply it immediately upon publication.

Workarounds

• Deploy a WAF rule that blocks requests containing script tags or JavaScript event handlers in parameters reaching the plugin
• Apply a strict Content Security Policy (CSP) that disallows inline scripts to limit XSS payload execution
• Restrict WordPress administrator access to specific source IP ranges using server-level controls

# Example nginx configuration to block common reflected XSS payloads
location ~* /wp-content/plugins/friendstore-for-woocommerce/ {
    if ($query_string ~* "(<|%3C)script") { return 403; }
    if ($query_string ~* "javascript:")     { return 403; }
    if ($query_string ~* "on(error|load|click)=") { return 403; }
}

# Add a Content Security Policy header site-wide
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;