CVE-2024-9237: Fish And Ships WooCommerce XSS Vulnerability

CVE-2024-9237 Overview

CVE-2024-9237 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Fish and Ships WooCommerce shipping table rate plugin for WordPress. All versions up to and including 1.5.9 are affected. The flaw stems from the use of add_query_arg without proper escaping on URLs within the plugin's wizard component. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The vulnerability is tracked under CWE-79 and requires user interaction to trigger.

Critical Impact
An unauthenticated attacker who tricks an administrator into clicking a crafted URL can execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, admin action forgery, or redirection to malicious content.

Affected Products

WP-Centrics Fish and Ships plugin for WordPress, all versions up to and including 1.5.9
WordPress installations running WooCommerce with the affected plugin enabled
Any site exposing the plugin's wizard.php endpoints to unauthenticated visitors

Discovery Timeline

2024-10-04 - CVE-2024-9237 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9237

Vulnerability Analysis

The vulnerability resides in the plugin's setup wizard component located in includes/wizard.php. According to the Wordfence advisory and WordPress plugin repository code review, unsafe URL construction occurs at lines 226, 369, and 479 of the file. The plugin passes user-controllable input through the WordPress add_query_arg() function and reflects the resulting URL back into rendered HTML without escaping. Because add_query_arg() preserves the current request's query string when no URL is supplied, an attacker can inject script payloads through crafted parameters that appear in generated links or form actions.

The attack requires user interaction, and the impact crosses a security scope boundary because injected scripts execute within the authenticated administrator context of the WordPress dashboard.

Root Cause

The root cause is missing output encoding on URLs produced by add_query_arg(). WordPress core documentation explicitly warns that the return value of this function is not escaped and must be passed through esc_url() before being emitted into HTML. The affected wizard code omits this sanitization, allowing reflected payloads such as "><script>...</script> to break out of the intended attribute context.

Attack Vector

Exploitation is network-based and requires no authentication or privileges. An attacker crafts a URL pointing to the vulnerable wizard endpoint with a malicious query string parameter, then delivers it via phishing email, chat, or a malicious website. When an authenticated WordPress administrator visits the link, the injected script executes in their browser with access to session cookies, CSRF tokens, and dashboard functionality.

See the Wordfence Vulnerability Report and the WordPress plugin code review for the vulnerable code locations.

Detection Methods for CVE-2024-9237

Indicators of Compromise

HTTP requests to wizard.php containing script tags, event handlers such as onerror= or onload=, or encoded payloads like %3Cscript%3E in query parameters
Web server access logs showing referrers from external domains directing users to plugin wizard URLs with unusual query strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains following visits to plugin pages
Creation of unauthorized WordPress administrator accounts or modification of user roles shortly after a suspicious admin session

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query parameters targeting /wp-content/plugins/fish-and-ships/ paths for XSS payload signatures
Enable WordPress audit logging to capture administrator actions correlated with suspicious referrer headers
Monitor for the presence of Fish and Ships plugin versions at or below 1.5.9 across managed WordPress inventory

Monitoring Recommendations

Alert on HTTP 200 responses from plugin wizard endpoints where request parameters contain HTML or JavaScript metacharacters
Correlate administrator session activity with recent inbound clicks from external referrers on plugin pages
Track browser-side content security policy violation reports if CSP is deployed for the WordPress admin interface

How to Mitigate CVE-2024-9237

Immediate Actions Required

Update the Fish and Ships plugin to a version newer than 1.5.9 as soon as a patched release is available from the vendor
Audit WordPress administrator accounts for unauthorized changes, new users, or altered roles since the plugin was installed
Restrict access to /wp-admin/ and plugin wizard endpoints by source IP address where feasible
Instruct administrators to avoid clicking links to their WordPress site received from untrusted sources

Patch Information

Review the WordPress Repository Changeset for vendor code changes related to this issue. Confirm the installed plugin version is greater than 1.5.9 before considering remediation complete. Verify remediation by reviewing the plugin's includes/wizard.php for proper use of esc_url() around add_query_arg() output.

Workarounds

Deactivate and remove the Fish and Ships plugin until an official patched version is installed
Deploy a WAF rule blocking requests to plugin wizard URLs that contain <, >, script, or javascript: tokens in query parameters
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution
Require administrators to use a dedicated browser profile for WordPress management, isolating session cookies from general browsing

bash

# Example ModSecurity rule to block XSS payloads targeting the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/fish-and-ships/" \
    "chain,id:1009237,phase:2,deny,status:403,log,msg:'CVE-2024-9237 XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"