CVE-2024-8629: WooCommerce Multilingual XSS Vulnerability

CVE-2024-8629 Overview

CVE-2024-8629 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress. The flaw affects all versions up to and including 5.3.7. It stems from the use of add_query_arg without appropriate escaping on the URL in class-wcml-comments.php. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is classified under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session by delivering a crafted URL, enabling session theft, credential harvesting, or administrative action abuse if the target holds elevated privileges.

Affected Products

WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress
All versions up to and including 5.3.7
WordPress sites using WPML for WooCommerce translation and currency management

Discovery Timeline

2024-10-08 - CVE-2024-8629 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8629

Vulnerability Analysis

The vulnerability resides in the plugin's comment handling logic within inc/class-wcml-comments.php. The affected code passes user-controllable URL parameters into WordPress's add_query_arg() function and echoes the result back into rendered HTML without proper output escaping. WordPress documentation explicitly warns that add_query_arg() returns unescaped input and must be sanitized with esc_url() before being emitted to the page. Because this escaping is missing, attackers can supply reflected payloads through URL parameters.

The vulnerability requires user interaction, typically a victim clicking a crafted link. Once triggered, the injected script executes in the context of the vulnerable WordPress site, inheriting cookies, session tokens, and Document Object Model (DOM) access rights of the browsing user.

Root Cause

The root cause is missing output escaping on data returned by add_query_arg(). This function preserves any query parameters present in the current request URL. When the plugin uses its return value directly in HTML attributes without wrapping it in esc_url() or an equivalent sanitizer, attacker-controlled input reaches the rendered page verbatim.

Attack Vector

An attacker crafts a URL targeting a WordPress page rendered by the WPML WooCommerce plugin. The URL embeds a malicious query parameter containing JavaScript payload fragments that break out of the surrounding HTML attribute context. The attacker delivers this URL through phishing email, social media, or a compromised third-party site. When the victim clicks the link, their browser fetches the page, the plugin reflects the tainted parameter into the response, and the payload executes in the victim's session context.

Exploitation potential increases significantly when the target victim is a logged-in administrator, as the payload can perform authenticated actions such as creating rogue accounts or modifying plugin settings. Technical details are available in the Wordfence Vulnerability Report and the upstream code changeset.

Detection Methods for CVE-2024-8629

Indicators of Compromise

HTTP requests to WordPress pages containing suspicious query strings with <script>, javascript:, onerror=, or onload= fragments
Referrer headers pointing to unfamiliar external domains preceding administrative actions
Unexpected new administrator accounts or plugin configuration changes shortly after user link interaction
Web server access logs showing URL-encoded HTML payloads targeting plugin endpoints

Detection Strategies

Deploy a Web Application Firewall (WAF) ruleset that inspects query parameters for reflected XSS payload patterns targeting WordPress
Correlate outbound browser telemetry with recent link clicks originating from WordPress-hosted pages using the WPML plugin
Monitor for anomalous JavaScript execution patterns on endpoints browsing to WordPress admin URLs
Review plugin version inventory to identify WordPress installations running WPML WooCommerce 5.3.7 or earlier

Monitoring Recommendations

Ingest WordPress access logs into a centralized logging platform and alert on requests containing reflected script markers
Track failed and successful administrative actions on WooCommerce sites and correlate them with preceding URL clicks
Enable and review browser console error logs on privileged workstations for signs of unexpected script execution
Baseline plugin file integrity and alert on modifications to class-wcml-comments.php or other WPML files

How to Mitigate CVE-2024-8629

Immediate Actions Required

Update the WooCommerce Multilingual & Multicurrency with WPML plugin to a version later than 5.3.7
Audit WordPress administrator accounts for unauthorized additions or role changes
Force password resets and invalidate active sessions for all privileged users on affected sites
Educate site administrators and editors to avoid clicking untrusted links, particularly while authenticated to WordPress admin

Patch Information

The vendor addressed the issue in a version released after 5.3.7. The upstream fix is visible in the WordPress plugin changeset 3164233, which applies proper escaping around the add_query_arg() output in class-wcml-comments.php. Site operators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Deactivate the WPML WooCommerce plugin until it can be updated on sites where patching is delayed
Deploy WAF rules that block requests containing common reflected XSS signatures against WordPress endpoints
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on WordPress-rendered pages
Restrict administrative access to trusted networks or via VPN to reduce exposure of privileged sessions to phishing links

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update woocommerce-multilingual

# Verify the installed version is above 5.3.7
wp plugin get woocommerce-multilingual --field=version