CVE-2024-1796 in Husky Plugin
Summary
by MITRE • 03/15/2024
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-1796 affects the HUSKY – Products Filter for WooCommerce Professional plugin, which is widely used within the WordPress ecosystem to enhance e-commerce functionality. This plugin specifically targets WooCommerce sites that require advanced product filtering capabilities, making it a common target for attackers seeking to exploit weaknesses in e-commerce platforms. The vulnerability stems from insufficient input sanitization and output escaping mechanisms within the plugin's shortcode implementation, particularly affecting the 'woof' shortcode that processes user-supplied attributes. The flaw exists in all versions up to and including 1.3.5.1, indicating a significant window of exposure where users were potentially at risk without awareness of the security gap.
The technical implementation of this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts through the 'swoof_slug' attribute parameter. This represents a classic stored cross-site scripting vulnerability where the malicious payload is stored on the server and executed when legitimate users access affected pages. The attack vector leverages the plugin's handling of user input without proper validation or sanitization, enabling attackers to manipulate the shortcode parameters in ways that bypass normal security measures. The vulnerability specifically targets the output escaping mechanisms that should prevent malicious code from being executed in the context of user sessions, creating a persistent threat that can affect multiple users who access pages containing the injected content.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the ability to perform various malicious activities within the context of the compromised WordPress installation. Contributors and higher-level users typically have significant permissions within WordPress environments, allowing attackers to potentially escalate their privileges or manipulate site content. The stored nature of the XSS vulnerability means that the malicious scripts remain active until the affected shortcode parameters are modified or the plugin is updated, creating a persistent threat that can be exploited repeatedly. This vulnerability also aligns with ATT&CK technique T1548.002 for privilege escalation and T1059.001 for command and scripting interpreter usage, as attackers can leverage the executed scripts to perform further malicious activities.
The security implications of this vulnerability are particularly concerning given the widespread use of WooCommerce plugins and the typical permissions granted to contributors within WordPress environments. Attackers can exploit this vulnerability to steal session cookies, redirect users to malicious sites, deface content, or potentially gain access to sensitive administrative functions. The vulnerability also demonstrates a failure in input validation practices that should be implemented according to CWE-79 standards for cross-site scripting prevention. Organizations using this plugin should immediately implement mitigation strategies including updating to patched versions, implementing additional input validation measures, and monitoring for suspicious activity within contributor accounts. The vulnerability highlights the importance of proper security testing and validation of plugin code before deployment, particularly for plugins handling user-supplied data in web applications.