CVE-2024-53714: Continue Shopping From Cart CSRF Flaw

CVE-2024-53714 Overview

CVE-2024-53714 is a Cross-Site Request Forgery (CSRF) vulnerability in the Irish_Cathal Continue Shopping From Cart WordPress plugin (continue-shopping-from-cart-page). The flaw affects all plugin versions up to and including 1.3. An attacker who tricks an authenticated administrator into visiting a crafted page can submit unauthorized requests that store malicious JavaScript in plugin settings. The resulting Stored Cross-Site Scripting (XSS) executes in the context of any user rendering the affected output. The weakness is tracked under CWE-352.

Critical Impact
Successful exploitation chains CSRF with Stored XSS, allowing attackers to inject persistent JavaScript into a WordPress site by abusing an authenticated administrator session.

Affected Products

Irish_Cathal Continue Shopping From Cart plugin for WordPress
Plugin slug: continue-shopping-from-cart-page
All versions from n/a through <= 1.3

Discovery Timeline

2024-12-02 - CVE-2024-53714 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53714

Vulnerability Analysis

The plugin exposes one or more state-changing endpoints that do not validate a per-request anti-CSRF token (WordPress nonce). An attacker hosts a page containing a forged form or fetch request targeting the plugin's settings handler. When an authenticated administrator visits that page, the browser automatically attaches session cookies and submits the request. The plugin accepts the request as legitimate and persists attacker-controlled input, which is later rendered without proper output encoding, producing Stored XSS.

The attack requires user interaction (a victim must visit the attacker's page) but no privileges on the target site. Because the injected payload is stored, every subsequent visitor to the affected view executes the attacker's JavaScript. Typical post-exploitation includes administrator session theft, creation of rogue admin accounts, SEO spam injection, and redirection to malware distribution sites.

Root Cause

The root cause is missing CSRF protection [CWE-352] on plugin form submissions. The handler does not call wp_verify_nonce() or check check_admin_referer() before writing user-supplied data to the database. Compounding this, the stored values are reflected into HTML without escaping through esc_html(), esc_attr(), or wp_kses(), enabling the XSS sink.

Attack Vector

Exploitation is network-based and depends on social engineering. The attacker delivers a link to a logged-in WordPress administrator through email, chat, comments, or a malicious advertisement. The victim's browser issues an authenticated POST request to the vulnerable plugin endpoint. The payload, often a <script> tag or event-handler attribute, is saved to plugin options and later rendered on the cart or shop page, executing in every visitor's browser session.

No proof-of-concept exploit code has been published. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-53714

Indicators of Compromise

Unexpected <script>, onerror, or onload content within WordPress wp_options rows associated with the continue-shopping-from-cart-page plugin.
Outbound HTTP requests from site visitors to attacker-controlled domains immediately after page load of cart or checkout views.
New or modified WordPress administrator accounts shortly after an admin clicks an external link.
Browser console errors referencing remote JavaScript files not part of the site's theme or plugin bundle.

Detection Strategies

Audit the wp_options table for plugin settings containing HTML tags, JavaScript event handlers, or encoded script payloads.
Inspect web server access logs for POST requests to wp-admin/admin.php or admin-post.php referencing the plugin without a matching prior GET to a plugin settings page.
Compare the HTTP Referer header on plugin configuration POSTs; requests originating from external domains are suspicious.
Review browser-side Content Security Policy (CSP) violation reports for inline script blocks rendered on storefront pages.

Monitoring Recommendations

Enable WordPress audit logging to record administrator-initiated option changes with source IP and referer.
Alert on creation of new administrator users or changes to user roles outside of approved change windows.
Monitor file integrity for theme and plugin directories to detect secondary payload drops following XSS execution.

How to Mitigate CVE-2024-53714

Immediate Actions Required

Deactivate and remove the continue-shopping-from-cart-page plugin until a fixed version is published.
Rotate WordPress administrator passwords and invalidate active sessions using wp_logout_all() or equivalent.
Inspect plugin settings and remove any stored values containing HTML or JavaScript content.
Review the WordPress users table for unauthorized administrator accounts created during the exposure window.

Patch Information

No vendor-released patched version is referenced in the available advisory data. Versions through 1.3 remain vulnerable. Monitor the Patchstack advisory and the official WordPress plugin repository for an updated release before reinstalling.

Workarounds

Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce CSRF exposure.
Deploy a Web Application Firewall rule that blocks POST requests to plugin endpoints lacking a valid same-origin Referer header.
Enforce a strict Content Security Policy that disallows inline scripts on storefront pages to limit Stored XSS impact.
Require administrators to use a separate browser profile or session for WordPress administration, avoiding general browsing while logged in.

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate continue-shopping-from-cart-page
wp plugin delete continue-shopping-from-cart-page

# Audit options table for suspicious stored content
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_name LIKE '%continue_shopping%' \
  AND (option_value LIKE '%<script%' OR option_value LIKE '%onerror=%');"