CVE-2024-54320: ICDSoft Reseller Store XSS Vulnerability

CVE-2024-54320 Overview

CVE-2024-54320 is a reflected cross-site scripting (XSS) vulnerability in the ICDSoft Reseller Store WordPress plugin. The flaw affects all versions up to and including 2.4.5 and stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by a victim, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and operates across a network attack vector, making phishing and social engineering the primary delivery mechanisms. Patchstack published the security advisory documenting this issue.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions performed in the context of the targeted user.

Affected Products

ICDSoft Reseller Store WordPress plugin (icdsoft-reseller-store)
All versions from initial release through 2.4.5
WordPress sites with the plugin installed and activated

Discovery Timeline

2024-12-13 - CVE-2024-54320 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54320

Vulnerability Analysis

The vulnerability is classified as reflected cross-site scripting under [CWE-79]. The ICDSoft Reseller Store plugin processes user-supplied input and reflects it back into the rendered HTML response without proper sanitization or output encoding. When a victim follows a specially crafted link, the attacker-controlled payload executes within the security context of the WordPress site.

Reflected XSS in a WordPress plugin can lead to session token theft, administrative action forgery, and redirection to attacker-controlled infrastructure. The scope change indicator in the CVSS metrics indicates the vulnerability can affect resources beyond the vulnerable component itself, such as authenticated admin sessions. The EPSS probability for this CVE is 0.197%.

Root Cause

The root cause is missing or insufficient input validation and output encoding in request parameters processed by the plugin. User-controlled data flows from HTTP request parameters directly into the HTML response without HTML entity encoding or contextual escaping. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() that should be applied to any reflected user input, but the plugin code paths leading to version 2.4.5 did not apply them consistently.

Attack Vector

The attack requires an authenticated or unauthenticated victim to click a malicious link containing the crafted XSS payload. The payload is reflected into the response page and executed by the victim's browser. Because privileges required are none and user interaction is required, the typical exploitation scenario involves phishing campaigns targeting administrators or customers of WordPress sites running the vulnerable plugin. The vulnerability mechanism is documented in the Patchstack Security Vulnerability Report.

Detection Methods for CVE-2024-54320

Indicators of Compromise

HTTP request logs containing URL parameters with <script>, javascript:, onerror=, or onload= substrings targeting plugin endpoints
Unexpected outbound requests from administrator browsers to unknown domains shortly after clicking emailed or shared links
WordPress admin accounts performing unauthorized configuration changes following a phishing campaign
Web server access logs showing encoded payloads such as %3Cscript%3E directed at icdsoft-reseller-store paths

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for reflected payloads containing HTML or JavaScript syntax in query parameters bound to the plugin
Correlate referrer headers with external email gateways to identify phishing-driven access patterns
Monitor WordPress audit logs for privileged actions immediately following requests containing suspicious query strings

Monitoring Recommendations

Enable Content Security Policy (CSP) report-only mode to capture inline script execution attempts originating from the plugin pages
Aggregate WordPress access logs in a centralized SIEM and alert on query strings exceeding normal length or containing HTML control characters
Review browser-side error reports for unexpected script origins on pages served by the icdsoft-reseller-store plugin

How to Mitigate CVE-2024-54320

Immediate Actions Required

Identify all WordPress installations running the ICDSoft Reseller Store plugin and confirm the installed version
Disable or remove the plugin on sites where an updated release is not available
Force password resets and invalidate active sessions for administrators who may have clicked untrusted links since the plugin was installed
Apply a WAF rule to block requests containing common XSS payloads targeting plugin endpoints

Patch Information

The vulnerability affects versions up to and including 2.4.5. Site administrators should consult the Patchstack Security Vulnerability Report for the current fixed release and upgrade once a patched version is published by the vendor.

Workarounds

Deactivate the ICDSoft Reseller Store plugin until a patched release is verified and deployed
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to WordPress admin URLs by IP allow-listing to reduce phishing exposure for privileged users

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1005432,phase:2,deny,status:403,\
    msg:'Blocked reflected XSS attempt targeting icdsoft-reseller-store'"