CVE-2024-9345: WooCommerce Delivery Date XSS Vulnerability

CVE-2024-9345 Overview

CVE-2024-9345 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Product Delivery Date for WooCommerce – Lite plugin for WordPress, developed by Tychesoftwares. The flaw affects all plugin versions up to and including 2.7.3. The vulnerability stems from the use of the add_query_arg function without proper escaping of the URL in the plugin's pro-notices component. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation is conditional and only works when admin notices are present on the targeted page. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session theft, administrative action hijacking, or redirection to malicious resources.

Affected Products

Tychesoftwares Product Delivery Date for WooCommerce – Lite (WordPress plugin)
All versions up to and including 2.7.3
Fixed in version 2.7.4

Discovery Timeline

2024-10-04 - CVE-2024-9345 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9345

Vulnerability Analysis

The vulnerability resides in the ts-pro-notices.php file within the includes/component/pro-notices-in-lite/ directory of the plugin. The affected code constructs URLs using WordPress's add_query_arg function without applying proper output escaping before rendering the URL into HTML attributes. When the plugin's pro-notices feature displays an admin notice, user-controlled query parameters from the current request URL are reflected back into the DOM. An attacker can append malicious query parameters that break out of the attribute context and execute JavaScript in the victim's browser.

Exploitation requires user interaction, specifically clicking a specially crafted link while authenticated to the vulnerable WordPress site. The attack succeeds only when the plugin's notices are actively rendered on the page the user visits.

Root Cause

The root cause is improper neutralization of input before it is written to a web page [CWE-79]. The add_query_arg function in WordPress is well-known for returning user-supplied, unescaped input from $_SERVER['REQUEST_URI']. Developers must wrap its output with esc_url() before echoing it into HTML. The vulnerable code path in ts-pro-notices.php omitted this escaping step on line 102 of the pre-patch source.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts a URL to the vulnerable WordPress site with malicious payload data appended as query parameters. The attacker then distributes the link through phishing emails, social media, or external websites. When a logged-in administrator or user with access to pages displaying the plugin's notices clicks the link, the payload executes in their browser session. Attackers can leverage this to steal authentication cookies, perform unauthorized administrative actions, or pivot into further site compromise.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin File Reference for technical details.

Detection Methods for CVE-2024-9345

Indicators of Compromise

Web server access logs containing requests to WordPress admin pages with suspicious query string parameters, especially those including <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers originating from untrusted external domains preceding requests to WordPress admin screens where the plugin's notices render.
Unexpected administrative actions, new user accounts, or plugin changes shortly after an administrator clicked an external link.

Detection Strategies

Review WordPress access logs for GET requests to pages that render the Product Delivery Date for WooCommerce – Lite plugin's admin notices with anomalous query parameters.
Deploy a Web Application Firewall (WAF) rule to flag requests containing common XSS payload patterns targeting WordPress admin endpoints.
Audit installed plugin versions across managed WordPress sites and flag any instance of the plugin at version 2.7.3 or earlier.

Monitoring Recommendations

Enable detailed HTTP request logging on the WordPress host and forward logs to a centralized analytics platform for query-string anomaly detection.
Monitor administrator session activity for unexpected API calls, settings changes, or user creations that could indicate a successful XSS-driven account takeover.
Alert on outbound HTTP requests from administrator browsers to unknown domains that could indicate exfiltration of session cookies or CSRF tokens.

How to Mitigate CVE-2024-9345

Immediate Actions Required

Update the Product Delivery Date for WooCommerce – Lite plugin to version 2.7.4 or later immediately through the WordPress admin dashboard.
Audit all WordPress sites in the environment to inventory affected plugin instances and prioritize patching for sites with active administrator accounts.
Educate administrators and privileged users about the risk of clicking untrusted links while authenticated to the WordPress backend.

Patch Information

Tychesoftwares released version 2.7.4 of the plugin, which applies proper escaping to the vulnerable URL output in ts-pro-notices.php. Review the fix in the official WordPress Changeset 3161353. Site operators should apply the patch via the WordPress plugin updater and verify the installed version is 2.7.4 or higher.

Workarounds

If immediate patching is not feasible, deactivate the Product Delivery Date for WooCommerce – Lite plugin until the update can be installed.
Deploy a WAF rule that blocks or sanitizes query string parameters containing script tags or JavaScript URI schemes directed at WordPress admin paths.
Restrict administrative access to the WordPress backend using IP allowlists or VPN requirements to reduce the attack surface for reflected XSS link bait.

bash

# Verify installed plugin version via WP-CLI
wp plugin get product-delivery-date-for-woocommerce-lite --field=version

# Update the plugin to the patched release
wp plugin update product-delivery-date-for-woocommerce-lite --version=2.7.4

# If patching is delayed, deactivate the plugin
wp plugin deactivate product-delivery-date-for-woocommerce-lite