CVE-2024-54328: Invoice Payment for WooCommerce XSS Flaw

CVE-2024-54328 Overview

CVE-2024-54328 is a reflected Cross-Site Scripting (XSS) vulnerability in the linknacional Invoice Payment for WooCommerce plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser when clicked. The vulnerability affects all plugin versions up to and including 1.7.2. Successful exploitation requires user interaction, but the impact crosses a security boundary (scope changed), allowing attackers to compromise session data, perform actions on behalf of authenticated users, or redirect victims to malicious content.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers to hijack sessions, steal credentials, or perform unauthorized actions in WooCommerce stores running the vulnerable plugin.

Affected Products

linknacional Invoice Payment for WooCommerce plugin (invoice-payment-for-woocommerce)
All versions from initial release through 1.7.2
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2024-12-13 - CVE-2024-54328 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54328

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Invoice Payment for WooCommerce WordPress plugin. Reflected XSS occurs when user-controlled input is echoed back in the HTTP response without proper sanitization or output encoding. An attacker delivers a crafted link to a victim through phishing, social engineering, or malicious websites. When the victim clicks the link, the injected JavaScript executes in the context of the vulnerable WordPress site.

The scope change indicator in the CVSS vector signals that the impact extends beyond the vulnerable component to other browser components such as cookies, the Document Object Model (DOM), and authenticated sessions. The EPSS score is 0.333%, placing this vulnerability in the 24.9th percentile for likelihood of exploitation in the next 30 days.

Root Cause

The plugin fails to sanitize or properly encode user-supplied input before reflecting it back in generated HTML pages. Input from URL parameters, form fields, or other request data is rendered directly into responses without applying WordPress-recommended escaping functions such as esc_html(), esc_attr(), or wp_kses(). This violates the principle of output encoding and allows HTML and script tags to be interpreted by the browser.

Attack Vector

The attack vector is network-based with low attack complexity. No authentication is required, but the victim must be tricked into clicking a crafted URL. The attacker injects JavaScript payloads into a vulnerable parameter handled by the plugin. When the victim's browser renders the response, the malicious script executes within the trust context of the WordPress site. This enables session token theft, credential harvesting via fake login forms, unauthorized administrative actions through CSRF chaining, and redirection to attacker-controlled domains.

The vulnerability manifests in input handling routines within the plugin's request processing logic. See the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2024-54328

Indicators of Compromise

HTTP requests to plugin endpoints containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=
Outbound network connections from web server processes to unfamiliar external domains following user clicks on crafted links
Unexpected JavaScript execution or DOM modifications observed in browser developer tools when visiting plugin-handled URLs
WordPress access logs showing reflected parameters echoed back in response bodies containing script payloads

Detection Strategies

Deploy a web application firewall (WAF) with rules targeting common XSS payload patterns in query strings and POST bodies
Inspect WordPress access and error logs for suspicious URL parameters containing HTML metacharacters such as <, >, and "
Run automated vulnerability scanners against staging environments to identify reflected input in plugin endpoints
Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress sites and forward to a centralized log analysis platform
Set alerts for anomalous referrer headers and outbound clicks from email security gateways pointing to plugin URLs
Track plugin version inventory across WordPress installations to identify unpatched instances
Correlate authentication anomalies such as session reuse from new IPs with recent user clicks on inbound links

How to Mitigate CVE-2024-54328

Immediate Actions Required

Identify all WordPress sites with the Invoice Payment for WooCommerce plugin installed at version 1.7.2 or earlier
Update the plugin to a version newer than 1.7.2 once the vendor releases a fix
If no patch is available, deactivate and remove the plugin until remediation is published
Force password resets and invalidate active sessions for administrative users who may have clicked suspicious links

Patch Information

The vulnerability affects all versions through 1.7.2. Monitor the Patchstack advisory and the plugin's WordPress.org repository page for fixed releases. Apply updates through the WordPress admin dashboard or via WP-CLI immediately after publication.

Workarounds

Deploy a WAF such as Patchstack, Wordfence, or Cloudflare with XSS protection rules enabled for the affected plugin endpoints
Implement a strict Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins
Restrict access to plugin functionality behind authentication and reverse-proxy filtering rules
Educate administrators and customers to avoid clicking unsolicited links pointing to the WooCommerce store