CVE-2024-9222: Paid Member Subscriptions XSS Vulnerability

CVE-2024-9222 Overview

CVE-2024-9222 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Paid Member Subscriptions WordPress plugin developed by Cozmoslabs. The flaw affects all versions up to and including 2.12.8. The root cause is the use of add_query_arg without proper URL escaping in the plugin's admin payments list table. Unauthenticated attackers can inject arbitrary web scripts that execute when a targeted user clicks a crafted link. The issue is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of a victim who clicks a malicious link, enabling session theft, admin action forgery, and content manipulation.

Affected Products

Cozmoslabs Paid Member Subscriptions plugin for WordPress — all versions through 2.12.8
Installations using the plugin's admin payments list table (class-admin-payments-list-table.php)
WordPress sites where administrators or privileged users interact with plugin admin pages

Discovery Timeline

2024-10-02 - CVE-2024-9222 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9222

Vulnerability Analysis

The vulnerability resides in the plugin's admin payments list table implementation. The affected code path invokes add_query_arg to construct pagination and filter URLs without escaping the resulting URL before rendering it back into the page. Because add_query_arg reflects the current request URI by default, any attacker-supplied query string components are echoed into the DOM. This behavior allows an attacker to inject HTML or JavaScript into the rendered admin page.

The attack requires user interaction, since the payload must be delivered via a crafted URL and clicked by an authenticated user with access to the affected admin screen. Successful exploitation runs in the context of the victim's WordPress session, so the impact scales with the victim's privileges. Administrator victims expose the site to full compromise via plugin installation, arbitrary post creation, or credential harvesting.

Root Cause

The root cause is missing output encoding on values returned by add_query_arg in includes/admin/class-admin-payments-list-table.php around line 155. WordPress core documentation explicitly warns that add_query_arg reflects unsanitized REQUEST_URI data and requires callers to wrap output in esc_url before emission. The plugin did not apply this escape.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker crafts a URL targeting the vulnerable admin endpoint with a malicious query string designed to break out of the reflected URL context. The attacker then delivers the link through phishing, forum posts, or social engineering. When a logged-in privileged user visits the link, the injected script executes in their browser session. See the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis for technical details on the affected code path.

// No verified proof-of-concept code is available.
// The vulnerability manifests when add_query_arg output is emitted
// into the admin payments list table without esc_url() wrapping.

Detection Methods for CVE-2024-9222

Indicators of Compromise

Web server access logs containing requests to WordPress admin pages with query string parameters containing HTML tags, javascript: schemes, or encoded script payloads
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
Creation of new administrator accounts, plugin installations, or theme modifications without a matching authenticated admin action

Detection Strategies

Inspect referrer and query string values on requests to the Paid Member Subscriptions admin payments screen for suspicious characters such as <, >, ", and script
Deploy a Web Application Firewall (WAF) rule that flags reflected XSS patterns targeting wp-admin endpoints associated with the plugin
Correlate email gateway telemetry with WordPress admin logins to identify potential phishing delivery of crafted URLs

Monitoring Recommendations

Enable WordPress audit logging to capture admin actions and cross-reference against expected administrator activity
Monitor for the plugin version reported by wp plugin list or the plugin's metadata to confirm all instances are on the patched release
Alert on anomalous browser sessions originating from admin accounts, particularly execution of unexpected JavaScript on wp-admin pages

How to Mitigate CVE-2024-9222

Immediate Actions Required

Update the Paid Member Subscriptions plugin to a version later than 2.12.8 on every WordPress site where it is installed
Audit administrator accounts for unexpected activity, new users, or plugin changes since October 2024
Enforce phishing-resistant authentication and remind administrators not to click plugin admin URLs from untrusted sources

Patch Information

Cozmoslabs addressed the flaw by wrapping the affected add_query_arg output with proper URL escaping. The fix was committed via WordPress Plugin Changeset Update. Site operators should install the patched release through the WordPress plugin updater or via WP-CLI. Verify the installed version reports higher than 2.12.8 after the update completes.

Workarounds

If patching is not immediately possible, deactivate the Paid Member Subscriptions plugin until the update can be applied
Restrict access to wp-admin by IP allowlist at the reverse proxy or WAF layer to reduce phishing exposure
Deploy a Content Security Policy (CSP) header on the WordPress site that limits inline script execution in the admin interface

bash

# Update the plugin using WP-CLI
wp plugin update paid-member-subscriptions

# Verify the installed version is newer than 2.12.8
wp plugin get paid-member-subscriptions --field=version