CVE-2024-54347 Overview
CVE-2024-54347 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the BAKKBONE Australia FloristPress (bakkbone-florist-companion) WordPress plugin. The flaw exists in all versions up to and including 7.2.0. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction but no privileges, and changes the security scope of the affected application.
Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed within the context of the victim's WordPress session.
Affected Products
- BAKKBONE Australia FloristPress (bakkbone-florist-companion) plugin versions up to and including 7.2.0
- WordPress sites running the FloristPress plugin
- Florist e-commerce deployments built on the WordPress FloristPress stack
Discovery Timeline
- 2024-12-13 - CVE-2024-54347 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54347
Vulnerability Analysis
The FloristPress plugin fails to properly sanitize or encode user-supplied input before reflecting it back in HTTP responses. This permits an attacker to inject arbitrary HTML and JavaScript into the rendered page. Because the vulnerability is reflected, the malicious payload travels in the request itself, typically as a URL parameter, and is echoed into the response without neutralization.
The attack requires user interaction. A victim must click a crafted link or visit a malicious page that triggers a request to the vulnerable endpoint. Once executed, the injected script runs in the origin of the WordPress site and can access cookies, session tokens, and the DOM.
The scope is marked as changed, meaning the vulnerability impacts resources beyond the vulnerable component, such as the broader WordPress administrative or user context. This corresponds to [CWE-79], Improper Neutralization of Input During Web Page Generation.
Root Cause
The root cause is missing output encoding and input validation in the plugin's request handlers. User-controllable parameters are inserted directly into HTML responses without being passed through WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses().
Attack Vector
An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter and delivers it through phishing, forums, or third-party sites. When the target visits the URL on a site running the vulnerable FloristPress plugin, the payload reflects into the response and executes in the browser. The EPSS score of 0.333% places this in the lower exploitation probability range, but reflected XSS remains a common building block in targeted phishing campaigns.
No verified exploitation code is publicly available. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.
Detection Methods for CVE-2024-54347
Indicators of Compromise
- HTTP requests to FloristPress plugin endpoints containing <script>, onerror=, onload=, or javascript: strings in query parameters
- URL-encoded payloads such as %3Cscript%3E or %3Cimg reflected in server responses
- Outbound requests from user browsers to attacker-controlled domains immediately after visits to FloristPress pages
- Unexpected administrative actions originating from valid user sessions after clicking external links
Detection Strategies
- Inspect web server access logs for FloristPress-related URLs containing HTML tags or JavaScript event handlers in parameters
- Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns against the bakkbone-florist-companion plugin paths
- Correlate referrer headers with suspicious external sources targeting WordPress login or admin pages
Monitoring Recommendations
- Enable WordPress audit logging for plugin requests and authentication events tied to FloristPress users
- Forward web server and WordPress logs to a centralized SIEM for correlation with phishing telemetry
- Monitor browser-side Content Security Policy (CSP) violation reports to surface attempted script injections
How to Mitigate CVE-2024-54347
Immediate Actions Required
- Identify all WordPress instances running the bakkbone-florist-companion plugin at version 7.2.0 or earlier
- Update FloristPress to a version released after 7.2.0 that addresses the reflected XSS issue
- Force logout of active sessions and rotate administrator credentials if exploitation is suspected
- Review WordPress user roles and remove any unauthorized accounts created during the exposure window
Patch Information
The vendor advisory is tracked through Patchstack. Administrators should consult the Patchstack WordPress Vulnerability entry for the fixed version and upgrade instructions. Apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Deploy a WAF rule to block requests containing HTML tags or JavaScript event handlers in FloristPress plugin parameters
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Temporarily disable the FloristPress plugin on affected sites until the patched version is installed
# Update FloristPress plugin via WP-CLI
wp plugin update bakkbone-florist-companion
# Verify the installed version
wp plugin get bakkbone-florist-companion --field=version
# Disable the plugin if a patched version is not yet available
wp plugin deactivate bakkbone-florist-companion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
