CVE-2024-8716 Overview
CVE-2024-8716 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the XT Ajax Add To Cart for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 1.1.2 and results from the use of add_query_arg without proper output escaping on the current URL. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The vulnerability is tracked under CWE-79 and requires user interaction to trigger.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or redirection to attacker-controlled infrastructure on affected WordPress sites.
Affected Products
- XT Ajax Add To Cart for WooCommerce plugin for WordPress, versions up to and including 1.1.2
- Vendor: xplodedthemes
- Fixed in version 1.1.3
Discovery Timeline
- 2024-09-24 - CVE-2024-8716 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8716
Vulnerability Analysis
The vulnerability resides in the plugin's system status component at xt-framework/includes/class-system-status.php. The affected code path constructs URLs using the WordPress add_query_arg() function and echoes the resulting value without applying an escaping function such as esc_url() or esc_attr(). When add_query_arg() is called without an explicit URL argument, it reflects the current request URI, including any attacker-controlled query parameters. This behavior allows arbitrary content from the request to be reflected back into the page context.
The issue is a client-side injection that requires the victim to click a crafted link. Because the payload executes in the origin of the vulnerable WordPress site, attackers can perform actions in the authenticated user's context, including administrative operations if the victim is a site administrator.
Root Cause
The root cause is missing output escaping on a reflected value derived from add_query_arg(). The WordPress developer documentation explicitly warns that the return value of add_query_arg() is not safe against XSS and must be passed through esc_url() before output. The version 1.1.2 code at class-system-status.php line 786 emits the URL directly, permitting script injection through crafted query parameters.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker crafts a URL to the vulnerable admin page containing a malicious query string that closes the current HTML attribute and injects a script payload. The attacker then delivers the link via phishing, forum posts, or messaging platforms. When an authenticated WordPress user, typically an administrator viewing the plugin's system status page, follows the link, the reflected payload executes in the browser. The resulting JavaScript can steal cookies, submit forged administrative requests, or pivot to further compromise. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-8716
Indicators of Compromise
- Web server access logs containing requests to WordPress admin pages with query parameters holding HTML or JavaScript syntax such as <script>, onerror=, or javascript:.
- Referrer headers indicating users arrived at the plugin's system status page from external or untrusted domains.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects query string values for reflected XSS payloads targeting /wp-admin/ paths associated with xt-woo-ajax-add-to-cart.
- Audit installed plugin versions across WordPress estates and flag any instance of XT Ajax Add To Cart for WooCommerce at version 1.1.2 or earlier.
- Correlate WordPress admin session activity with unusual referrers or query string anomalies in reverse-proxy logs.
Monitoring Recommendations
- Alert on administrative logins followed by anomalous configuration changes or new user creation within a short time window.
- Monitor for outbound HTTP requests from workstations used by WordPress administrators to newly registered or low-reputation domains.
- Track plugin update activity to confirm remediation is applied fleet-wide.
How to Mitigate CVE-2024-8716
Immediate Actions Required
- Update XT Ajax Add To Cart for WooCommerce to version 1.1.3 or later on all WordPress sites.
- Notify site administrators to avoid clicking untrusted links, particularly links targeting /wp-admin/ paths, until patching is complete.
- Review WordPress administrator accounts for signs of unauthorized changes since September 2024.
Patch Information
The vendor released version 1.1.3 which adds proper output escaping to the affected URL construction. The fix is committed in the plugin's Subversion repository as changeset 3151911. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.
Workarounds
- Deactivate and remove the XT Ajax Add To Cart for WooCommerce plugin if immediate patching is not feasible.
- Restrict access to /wp-admin/ using IP allowlisting at the reverse proxy or WAF layer to reduce the attack surface for reflected XSS against administrators.
- Enforce a strict Content Security Policy (CSP) on the WordPress admin domain to limit inline script execution.
# Update the plugin using WP-CLI
wp plugin update xt-woo-ajax-add-to-cart --version=1.1.3
# Verify installed version
wp plugin get xt-woo-ajax-add-to-cart --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
