CVE-2024-54305: J&T Express Malaysia XSS Vulnerability

CVE-2024-54305 Overview

CVE-2024-54305 is a reflected Cross-Site Scripting (XSS) vulnerability in the J&T Express Malaysia WordPress plugin (jt-express). The flaw affects all versions up to and including 2.0.13 and stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of any victim who clicks the link. Because the vulnerability has a changed scope and requires user interaction, successful exploitation can affect components beyond the vulnerable plugin itself, including session data and authenticated WordPress sessions.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, potentially hijacking authenticated WordPress sessions and performing actions as the targeted user.

Affected Products

J&T Express Malaysia WordPress plugin (jt-express)
All versions from initial release through 2.0.13
WordPress sites with the plugin installed and active

Discovery Timeline

2024-12-13 - CVE-2024-54305 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54305

Vulnerability Analysis

The J&T Express Malaysia plugin fails to sanitize or encode user-supplied input before reflecting it back into HTML responses. This category of flaw, classified as [CWE-79], allows attackers to inject HTML and JavaScript into the rendered page output. The reflected variant requires the victim to interact with a crafted URL, typically delivered via phishing or malicious links on third-party sites.

When the victim clicks the link, the injected payload executes in the context of the WordPress site's origin. Attackers can leverage this access to steal session cookies, perform actions on behalf of authenticated administrators, or redirect users to attacker-controlled infrastructure. The EPSS probability of 0.41% indicates moderate exploitation likelihood relative to all published CVEs.

Root Cause

The root cause is missing input validation and output encoding within the plugin's request handling logic. User-controllable parameters are written directly into HTML responses without escaping characters such as <, >, ", and '. WordPress provides functions including esc_html(), esc_attr(), and wp_kses() for safe output, but the affected code paths do not apply them.

Attack Vector

Exploitation requires no authentication and can be triggered over the network. The attacker constructs a URL targeting a vulnerable endpoint of the plugin with a JavaScript payload in a reflected parameter. The victim must click the link or visit an attacker-controlled page that triggers the request. Once the payload executes, the attacker gains the ability to run arbitrary client-side code under the WordPress site's origin.

No verified proof-of-concept code is publicly available. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-54305

Indicators of Compromise

Web server access logs containing requests to jt-express plugin endpoints with URL parameters including <script>, javascript:, onerror=, or encoded equivalents such as %3Cscript%3E
Unusual outbound requests from administrator browsers to unfamiliar domains shortly after visiting the WordPress site
Unexpected modifications to WordPress user accounts, posts, or plugin settings following an administrator session

Detection Strategies

Inspect HTTP request and response pairs for reflected parameter values containing HTML or JavaScript syntax
Deploy a Web Application Firewall (WAF) with rules targeting OWASP CRS XSS signatures for WordPress plugin paths
Correlate referer headers pointing to external domains with parameter-rich requests to plugin endpoints

Monitoring Recommendations

Enable verbose access logging on the WordPress web server and forward logs to a centralized analytics platform
Monitor for spikes in 4xx and 2xx responses on jt-express endpoints with long or encoded query strings
Alert on administrator account activity originating from unusual IP addresses or user agents

How to Mitigate CVE-2024-54305

Immediate Actions Required

Update the J&T Express Malaysia plugin to a version newer than 2.0.13 once the vendor publishes a patched release
If no patched version is available, deactivate and remove the plugin from all WordPress installations
Force password resets for WordPress administrator accounts that may have visited crafted links

Patch Information

At the time of publication, the Patchstack advisory lists versions through 2.0.13 as vulnerable. Site administrators should monitor the WordPress plugin repository and the vendor's release notes for a fixed version and apply it immediately upon availability.

Workarounds

Deploy a WAF rule set that blocks requests containing common XSS payloads targeting the plugin's parameters
Apply a Content Security Policy (CSP) header that restricts inline script execution and limits trusted script sources
Restrict access to the WordPress admin interface by IP allowlist to reduce the attack surface for authenticated victims

bash

# Example nginx configuration adding a restrictive Content-Security-Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;