CVE-2024-9239: Booster for WooCommerce XSS Vulnerability

CVE-2024-9239 Overview

CVE-2024-9239 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Booster for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 7.2.3. The plugin uses add_query_arg and remove_query_arg without properly escaping the URL, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking a user into clicking a crafted link. The vulnerability is classified under CWE-79 and impacts confidentiality and integrity within the victim's browser session.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser via a crafted link, enabling session hijacking, credential theft, and administrative action forgery on affected WordPress sites.

Affected Products

Booster for WooCommerce plugin for WordPress (all versions up to and including 7.2.3)
WordPress installations using the vulnerable woocommerce-jetpack package
Sites exposing the PDF invoicing advanced settings and order statuses tool endpoints

Discovery Timeline

2024-11-20 - CVE-2024-9239 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9239

Vulnerability Analysis

The vulnerability resides in the Booster for WooCommerce plugin, distributed as woocommerce-jetpack. The affected code paths reside in includes/settings/wcj-settings-pdf-invoicing-advanced.php and includes/tools/class-wcj-order-statuses-tool.php. Both files invoke the WordPress helpers add_query_arg() and remove_query_arg() on the current request URL and echo the result into administrative pages without escaping the output.

WordPress documentation explicitly warns that these helper functions do not sanitize input and reuse untrusted values from the current request. When the returned URL is emitted into HTML attributes without passing through esc_url() or esc_attr(), attacker-controlled query parameters break out of the attribute context and execute in the browser.

Root Cause

The root cause is missing output encoding. The plugin trusts the URL returned by add_query_arg and remove_query_arg, which preserves attacker-controlled query string values from $_SERVER['REQUEST_URI']. Without wrapping the output in esc_url(), injected HTML and JavaScript payloads reach the DOM intact, satisfying the conditions for reflected XSS under CWE-79.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL targeting a vulnerable plugin page with a malicious payload appended as a query parameter. When an authenticated user, typically a store administrator, clicks the link, the payload reflects into the response and executes in their browser under the site origin. This enables actions such as stealing authentication cookies, submitting forged administrative requests, or planting persistent backdoors through subsequent authenticated operations.

Because the vulnerable code paths are administrative settings and tools, attackers commonly pair the payload with phishing aimed at shop managers. Technical specifics are documented in the WordPress Plugin PDF Invoicing Settings and WordPress Tool for Order Statuses references.

Detection Methods for CVE-2024-9239

Indicators of Compromise

Requests to /wp-admin/ pages containing HTML entities, <script> tags, javascript: schemes, or event handlers such as onerror= within query strings
Access log entries showing long, URL-encoded query parameters targeting wcj-settings-pdf-invoicing-advanced or order status tool endpoints
Referer headers pointing to external domains preceding administrative page loads
Unexpected outbound requests from administrator browser sessions to attacker-controlled hosts

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns in query strings targeting woocommerce-jetpack paths
Inspect WordPress access logs for query parameters containing angle brackets, %3Cscript%3E, %22, or common XSS payload markers
Monitor for administrator sessions performing anomalous plugin, user, or theme modifications shortly after clicking external links

Monitoring Recommendations

Forward WordPress web server logs to a centralized analytics platform and alert on suspicious query strings hitting Booster plugin endpoints
Enable audit logging on WordPress administrator accounts and correlate role changes with recent authentication events
Track plugin version inventory across managed WordPress hosts and flag any instance running Booster for WooCommerce at or below version 7.2.3

How to Mitigate CVE-2024-9239

Immediate Actions Required

Update Booster for WooCommerce to a version released after 7.2.3 on all WordPress sites
Restrict administrative access to the WordPress dashboard using IP allow-lists or VPN gating where feasible
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on /wp-admin/ pages
Rotate WordPress administrator passwords and invalidate active sessions if suspicious link clicks are suspected

Patch Information

The vendor addressed the issue in the plugin repository. Review the fix in the WordPress Plugin ChangeSet and consult the Wordfence Vulnerability Report for the fixed version and additional guidance. Apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the Booster for WooCommerce plugin until the patched release is installed
Train administrators to avoid clicking untrusted links that reference WordPress admin paths or plugin settings pages
Deploy browser-side XSS mitigations such as CSP headers with script-src 'self' and disable unsafe inline scripts on administrative routes

bash

# Update the plugin using WP-CLI
wp plugin update woocommerce-jetpack

# Verify the installed version
wp plugin get woocommerce-jetpack --field=version

# If a patched version is not yet available, deactivate the plugin
wp plugin deactivate woocommerce-jetpack