CVE-2024-9356: Yotpo for WooCommerce XSS Vulnerability

CVE-2024-9356 Overview

CVE-2024-9356 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.7.9. It stems from insufficient input sanitization and output escaping in the yotpo_user_email and yotpo_user_name parameters. Unauthenticated attackers can inject arbitrary web scripts into pages rendered by the plugin. Execution requires a victim to click a crafted link, satisfying the user interaction requirement. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on November 15, 2024.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, or redirection to attacker-controlled infrastructure.

Affected Products

Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress, versions 1.0 through 1.7.9
WordPress sites running WooCommerce with the vulnerable Yotpo integration installed
Any deployment exposing the plugin's settings endpoints to unauthenticated visitors

Discovery Timeline

2024-11-15 - CVE-2024-9356 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9356

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the plugin's settings handling logic. The affected code path resides in lib/utils/wc-yotpo-settings-functions.php around line 100, as referenced in the WordPress Plugin Function File. The plugin reads the yotpo_user_email and yotpo_user_name request parameters and reflects them back into HTML output without adequate sanitization or contextual escaping. When a victim loads a crafted URL, the browser parses attacker-supplied markup as trusted content and executes any embedded scripts.

Root Cause

The root cause is the absence of proper input sanitization functions such as sanitize_text_field() on inbound parameters and output escaping functions such as esc_html() or esc_attr() on rendered values. Because WordPress provides these APIs specifically to neutralize HTML metacharacters, their omission allows raw <script> payloads and event-handler attributes to reach the DOM. The fix was applied in the plugin repository as documented in the WordPress Plugin Changeset Update.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to the vulnerable WordPress endpoint with malicious JavaScript embedded in the yotpo_user_email or yotpo_user_name query parameter. The attacker then delivers the link through phishing email, social media, or a compromised page. When an authenticated administrator opens the link, the injected script executes with that user's privileges, enabling session hijacking, administrative action forgery, or persistent backdoor installation via plugin editor abuse. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2024-9356

Indicators of Compromise

HTTP requests to WordPress endpoints containing yotpo_user_email or yotpo_user_name parameters with URL-encoded <script>, onerror=, or javascript: payloads
Referrer headers pointing to unfamiliar external domains preceding suspicious plugin-related requests
Outbound connections from administrator browser sessions to unknown domains shortly after clicking emailed or shared links
Unexpected creation of WordPress administrator accounts or modifications to theme and plugin files

Detection Strategies

Deploy web application firewall (WAF) signatures that flag HTML and JavaScript metacharacters in the two affected query parameters
Review WordPress access logs for GET requests targeting the plugin with encoded angle brackets, quote characters, or event-handler keywords
Correlate phishing email telemetry with subsequent visits to WordPress admin URLs containing the vulnerable parameters

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress reverse proxy and retain logs for at least 90 days
Monitor for anomalous administrator session behavior including cookie changes, new user creation, and plugin installation events
Alert on any modifications to files under the yotpo-social-reviews-for-woocommerce plugin directory

How to Mitigate CVE-2024-9356

Immediate Actions Required

Upgrade the Yotpo: Product & Photo Reviews for WooCommerce plugin to a version later than 1.7.9
If an immediate upgrade is not feasible, deactivate and remove the plugin from all affected WordPress installations
Force logout of all WordPress administrator sessions and rotate credentials for privileged accounts
Audit recent plugin, theme, and user account changes for signs of exploitation

Patch Information

The vendor addressed the vulnerability in a subsequent plugin release. The patch adds proper sanitization and escaping to the yotpo_user_email and yotpo_user_name parameters. Administrators should apply the update through the WordPress admin dashboard under Plugins → Installed Plugins, or by downloading the latest release from the WordPress Plugin Changeset Update. No public exploit or CISA KEV listing is currently associated with this CVE.

Workarounds

Configure a WAF rule to block or strip HTML metacharacters from the yotpo_user_email and yotpo_user_name parameters
Restrict access to the WordPress admin interface by source IP address using web server ACLs
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources
Train administrators to avoid clicking unsolicited links that reference their WordPress site domain

bash

# Example ModSecurity rule to block script payloads in the vulnerable parameters
SecRule ARGS:yotpo_user_email|ARGS:yotpo_user_name "@rx (?i)(<script|onerror=|javascript:|onload=)" \
    "id:1009356,phase:2,deny,status:403,log,msg:'CVE-2024-9356 Yotpo XSS attempt blocked'"