CVE-2024-9384: WPFactory Quantity Pricing Plugin XSS Flaw

CVE-2024-9384 Overview

CVE-2024-9384 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 3.8.0. It stems from unsafe use of the add_query_arg function without proper escaping on the URL. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The vulnerability is tracked as CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or administrative action hijacking on WordPress sites running the vulnerable plugin.

Affected Products

WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin, all versions through 3.8.0
WordPress sites with the wholesale-pricing-woocommerce plugin installed
WooCommerce storefronts relying on the plugin's per-product pricing settings module

Discovery Timeline

2024-10-04 - CVE-2024-9384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9384

Vulnerability Analysis

The vulnerability resides in the class-alg-wc-wholesale-pricing-settings-per-product.php file within the plugin's settings module. The plugin calls WordPress's add_query_arg function using URL data that is not sanitized or escaped before being reflected back into the page. When user-controlled input is appended to a URL and rendered in HTML output without escaping, an attacker can inject arbitrary JavaScript. The injected payload executes in the browser of any user who visits the crafted URL.

Reflected XSS requires user interaction, typically through phishing or social engineering. Once the payload runs, it executes in the security context of the target WordPress site. If an administrator clicks the malicious link, the attacker can leverage the browser session to perform privileged actions.

Root Cause

The root cause is improper output escaping of URL parameters passed to add_query_arg. WordPress's own documentation warns that add_query_arg returns unescaped output and requires explicit escaping via esc_url before being echoed. The plugin failed to apply this escaping in the affected settings file, allowing attacker-controlled query parameters to be reflected into the DOM.

Attack Vector

An attacker crafts a URL that includes a malicious JavaScript payload as a query parameter. The attacker delivers the link through email, social media, or a compromised web page. When an authenticated WordPress user (typically a store administrator) clicks the link, the vulnerable page reflects the payload into the response. The browser executes the script under the origin of the WordPress site. Consequences include session cookie theft, unauthorized administrative actions, plugin or theme modification, and account takeover. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Plugin Code File.

Detection Methods for CVE-2024-9384

Indicators of Compromise

Web server access logs containing WooCommerce admin URLs with query parameters holding <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
Unexpected outbound requests from administrator browser sessions to unfamiliar domains shortly after clicking external links
New or modified WordPress administrator accounts created without a corresponding audit trail
Referrer headers in admin traffic pointing to external phishing or link-shortener domains

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects query strings for XSS payload patterns targeting the wholesale-pricing-woocommerce plugin paths
Enable WordPress security plugin scanning to detect the vulnerable plugin version 3.8.0 and earlier
Correlate administrator authentication events with subsequent configuration changes to identify session hijacking indicators

Monitoring Recommendations

Monitor administrator user-agent and IP consistency to detect stolen session usage
Log and alert on modifications to WordPress user roles, plugin files, and theme files
Track query parameter patterns hitting /wp-admin/ endpoints for reflected XSS signatures

How to Mitigate CVE-2024-9384

Immediate Actions Required

Update the Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin to version 3.8.1 or later
Force password resets and invalidate active sessions for all WordPress administrator accounts
Audit administrator accounts and installed plugins for unauthorized changes made since October 2024

Patch Information

WPFactory released version 3.8.1 to remediate the vulnerability. The fix applies proper URL escaping to the add_query_arg output in class-alg-wc-wholesale-pricing-settings-per-product.php. Review the official WordPress Plugin Changeset for the code-level fix.

Workarounds

Deactivate the plugin until version 3.8.1 or later can be installed
Restrict WordPress admin panel access by IP allowlist via web server or WAF configuration
Require administrators to use a dedicated browser profile with no persistent session cookies for WordPress management tasks

bash

# Update the plugin via WP-CLI
wp plugin update wholesale-pricing-woocommerce --version=3.8.1

# Verify installed version
wp plugin get wholesale-pricing-woocommerce --field=version