CVE-2024-9205: WPFactory Maximum Products Per User XSS Flaw

CVE-2024-9205 Overview

CVE-2024-9205 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Maximum Products per User for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.2.8. The vulnerability stems from the use of add_query_arg without proper URL escaping in class-alg-wc-mppu-users.php. Unauthenticated attackers can inject arbitrary web scripts into pages. Execution requires tricking an authenticated user into clicking a crafted link. The issue is tracked under CWE-79 and was patched in version 4.2.9.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of a victim user, enabling session hijacking, credential theft, and administrative action abuse on affected WordPress sites.

Affected Products

WPFactory Maximum Products per User for WooCommerce (free, WordPress)
All versions up to and including 4.2.8
Fixed in version 4.2.9

Discovery Timeline

2024-10-10 - CVE-2024-9205 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9205

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw located in the plugin's class-alg-wc-mppu-users.php file. The affected code path uses WordPress's add_query_arg() function to build URLs that are later rendered in administrative or user-facing pages. Because the returned value is not passed through esc_url() or an equivalent output-encoding function, attacker-controlled query parameters are reflected into the HTML response verbatim. The vulnerability requires user interaction, typically through a phishing link that targets an authenticated administrator or shop manager.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The vulnerable sink is a call to add_query_arg whose return value is emitted into the page without URL or HTML escaping. The add_query_arg() function in WordPress reflects the current request URI by default, allowing attackers to inject payloads via arbitrary query parameters that are then echoed back inside anchor tags or form actions.

Attack Vector

The attack is network-based and requires no authentication from the attacker. An attacker crafts a URL to the vulnerable WordPress site containing an XSS payload inside a query parameter. The attacker delivers this URL to a logged-in user through phishing, forum posts, or other social engineering. When the victim visits the URL, the plugin reflects the unescaped payload into the response, executing script in the victim's browser under the site's origin. Because the CVSS scope is changed, successful exploitation can affect resources beyond the vulnerable component, such as administrator sessions.

No verified proof-of-concept code is available in the referenced sources. See the WordPress Plugin Code Review for the vulnerable sink and the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2024-9205

Indicators of Compromise

HTTP request logs containing suspicious query parameters with <script>, javascript:, onerror=, or encoded script payloads directed at URLs served by the plugin.
Referer headers pointing to external domains preceding administrator access to pages rendered by class-alg-wc-mppu-users.php.
Unexpected outbound requests from administrator browser sessions to attacker-controlled hosts following link clicks.

Detection Strategies

Inventory WordPress deployments and flag any instance of maximum-products-per-user-for-woocommerce at version 4.2.8 or earlier.
Enable WordPress audit logging to capture administrative actions that follow query-string anomalies.
Deploy a web application firewall rule that inspects query parameters for XSS signatures on URLs matching the plugin's admin endpoints.

Monitoring Recommendations

Monitor web server access logs for request URIs containing HTML tags, event handlers, or URL-encoded script fragments.
Alert on administrator sessions issuing API calls or form submissions immediately after loading a URL containing user-controlled query parameters.
Track plugin version drift across managed WordPress sites to ensure patched versions remain deployed.

How to Mitigate CVE-2024-9205

Immediate Actions Required

Update the Maximum Products per User for WooCommerce plugin to version 4.2.9 or later on all affected WordPress sites.
Instruct administrators and shop managers to avoid clicking unsolicited links to the WordPress site, particularly those containing long query strings.
Review admin audit logs for suspicious activity performed between the plugin's installation date and the upgrade date.

Patch Information

The vendor released a fix in version 4.2.9 via the WordPress plugin repository. The remediation adjusts the handling in class-alg-wc-mppu-users.php so URLs produced by add_query_arg are properly escaped before being rendered. Review the WordPress Plugin Change Log for the exact code changes applied.

Workarounds

Deactivate the Maximum Products per User for WooCommerce plugin until the patched version 4.2.9 can be installed.
Deploy a WAF rule that blocks requests containing script tags, javascript: URIs, or common event handler attributes in query parameters.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce exploit impact.

bash

# Update the vulnerable plugin via WP-CLI
wp plugin update maximum-products-per-user-for-woocommerce --version=4.2.9

# Verify the installed version
wp plugin get maximum-products-per-user-for-woocommerce --field=version