CVE-2024-52484: WC Recently Viewed Products XSS Flaw

CVE-2024-52484 Overview

CVE-2024-52484 is a reflected cross-site scripting (XSS) vulnerability in the wc-recently-viewed-products WordPress plugin developed by deepintowp. The flaw affects all plugin versions up to and including 1.0.1. The vulnerability stems from improper neutralization of user input during web page generation, classified under [CWE-79]. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when clicked. Successful exploitation requires user interaction and operates across a network attack vector.

Critical Impact
Attackers can hijack user sessions, steal authentication cookies, deface site content, or redirect visitors to malicious destinations through crafted links targeting WordPress sites running the vulnerable plugin.

Affected Products

deepintowp WC Recently Viewed Products plugin for WordPress
All versions from initial release through 1.0.1
WordPress sites with WooCommerce integration using this plugin

Discovery Timeline

2024-12-02 - CVE-2024-52484 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-52484

Vulnerability Analysis

The wc-recently-viewed-products plugin extends WooCommerce by displaying products that users have recently viewed. The plugin fails to sanitize user-supplied input before reflecting it in HTTP responses. An attacker can inject JavaScript payloads into URL parameters that are processed and rendered by the plugin without proper encoding.

This class of reflected XSS requires the victim to click a crafted link. Once executed, the injected script runs in the security context of the WordPress site, granting the attacker access to session cookies, local storage, and the DOM. The scope-changed attribute indicates the exploit can affect resources beyond the vulnerable component.

Root Cause

The root cause is missing output encoding on user-controlled data echoed into HTML responses. Input passed through URL parameters reaches the page-rendering logic without escaping via WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This permits raw HTML and JavaScript to be embedded in the generated page.

Attack Vector

An attacker constructs a URL containing JavaScript payloads in vulnerable parameters consumed by the plugin. The attacker delivers this URL through phishing emails, social media posts, or malicious websites. When an authenticated administrator or shopper clicks the link, the payload executes in their browser session. The attacker can then exfiltrate session tokens, perform actions on behalf of the user, or pivot to additional attacks against the WordPress backend.

No verified public exploit code is available. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-52484

Indicators of Compromise

HTTP requests containing URL-encoded <script> tags, javascript: URIs, or event handlers such as onerror= and onload= targeting plugin endpoints
Web server access logs showing crafted query strings directed at wc-recently-viewed-products URLs
Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after clicking inbound links
WordPress audit logs showing session activity or privilege changes from unusual IP addresses

Detection Strategies

Deploy a web application firewall (WAF) with rules that flag XSS payload patterns in query parameters
Inspect HTTP response bodies for reflected payloads matching incoming request parameters
Correlate referer headers with administrator logins to identify suspicious click-through patterns
Enable WordPress security plugins that monitor file integrity and unexpected JavaScript execution

Monitoring Recommendations

Monitor /wp-content/plugins/wc-recently-viewed-products/ endpoints for anomalous parameter values
Alert on browser console errors and Content Security Policy violations reported by administrators
Track outbound DNS queries from administrator workstations following WordPress sessions
Review WooCommerce order activity for unauthorized modifications that may indicate session hijacking

How to Mitigate CVE-2024-52484

Immediate Actions Required

Audit all WordPress installations for the wc-recently-viewed-products plugin at version 1.0.1 or earlier
Deactivate and remove the plugin until a patched release is verified
Force password resets and invalidate active sessions for administrator accounts
Implement a strict Content Security Policy (CSP) to restrict inline script execution across the site

Patch Information

No fixed version is identified in the available references. Refer to the Patchstack Vulnerability Report for vendor updates and confirm any plugin update remediates the reflected XSS before reinstalling.

Workarounds

Deploy WAF rules that block requests containing common XSS payload signatures targeting the plugin path
Apply a restrictive Content Security Policy that disallows inline scripts and unknown script sources
Restrict WordPress administrator access to trusted IP addresses using server-level controls
Train administrators and customers to avoid clicking unsolicited links pointing to the WordPress site

bash

# Example nginx rule blocking common XSS patterns on the plugin path
location ~* /wp-content/plugins/wc-recently-viewed-products/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}