CVE-2021-47984: WP24 Domain Check XSS Vulnerability

CVE-2021-47984 Overview

CVE-2021-47984 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin WP24 Domain Check version 1.6.2. The flaw resides in the plugin's settings handler, where the fieldnameDomain parameter submitted through options.php is stored without proper sanitization or output encoding. Authenticated attackers with access to the plugin settings form can inject arbitrary JavaScript payloads that execute in the browser of any administrator who later views the settings page. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in administrator browsers, enabling session theft, privilege abuse, and full WordPress site takeover through stored payloads in the WP24 Domain Check plugin.

Affected Products

WordPress Plugin WP24 Domain Check version 1.6.2
WordPress installations with the WP24 Domain Check plugin enabled
Administrator and editor accounts that view the plugin settings page

Discovery Timeline

2026-06-08 - CVE-2021-47984 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2021-47984

Vulnerability Analysis

The vulnerability is a stored XSS issue in the WP24 Domain Check plugin's administrative settings interface. The plugin accepts user input through the fieldnameDomain parameter when settings are saved via options.php. The submitted value is persisted to the WordPress options table and later rendered back into the settings page HTML without output encoding.

When an administrator subsequently loads the plugin settings page, the stored payload is reflected into the page source and executed by the browser in the context of the WordPress admin origin. This grants the injected script access to the administrator session, cookies, and CSRF nonces. An attacker can leverage this access to create new administrative users, install malicious plugins, or modify site content.

Because the payload is persisted, exploitation does not require the attacker to maintain an active session. The injected script executes every time the settings page is viewed, providing a reliable foothold within the WordPress administration interface.

Root Cause

The root cause is missing input sanitization and output escaping on the fieldnameDomain parameter. The plugin does not apply WordPress core helpers such as sanitize_text_field() on input or esc_attr() / esc_html() on output, allowing raw HTML and script tags to be stored and rendered.

Attack Vector

Exploitation requires an authenticated session with permission to submit the plugin's settings form at options.php. The attacker submits a crafted value containing JavaScript in the fieldnameDomain parameter. The payload is stored in the WordPress database and triggered when any administrator visits the WP24 Domain Check settings page, requiring minimal user interaction. Technical details are documented in the Exploit-DB entry #49377 and the VulnCheck Security Advisory.

The vulnerability manifests in the plugin's settings save handler. No verified exploit code is reproduced here; refer to the linked advisories for proof-of-concept details.

Detection Methods for CVE-2021-47984

Indicators of Compromise

Unexpected <script>, onerror, or onload strings stored in the wp_options table entries associated with the WP24 Domain Check plugin
POST requests to /wp-admin/options.php containing HTML or JavaScript syntax in the fieldnameDomain parameter
Creation of new WordPress administrator accounts shortly after a settings page visit by an existing admin
Outbound requests from administrator browsers to unfamiliar domains after loading the plugin settings page

Detection Strategies

Inspect the wp_options table for plugin option values that contain HTML tags or JavaScript keywords such as script, javascript:, or event handlers
Review web server access logs for authenticated POST requests to options.php that include suspicious payloads in plugin parameters
Apply web application firewall rules that flag script tags and event-handler attributes in WordPress admin form submissions

Monitoring Recommendations

Enable WordPress audit logging to capture all plugin settings changes, including the submitting user, timestamp, and submitted values
Monitor administrator session activity for anomalous actions such as new user creation or plugin installation following a settings page view
Alert on additions of installed but inactive plugins or unexpected modifications to wp_users and wp_usermeta tables

How to Mitigate CVE-2021-47984

Immediate Actions Required

Deactivate and remove the WP24 Domain Check plugin version 1.6.2 from all WordPress installations until a patched release is verified
Audit the wp_options table for any stored payloads in plugin option values and remove malicious content
Rotate WordPress administrator passwords and invalidate active sessions to revoke any tokens obtained through prior exploitation
Restrict access to /wp-admin/options.php by IP address or VPN where operationally feasible

Patch Information

No vendor patch is referenced in the available advisory data. Administrators should consult the WP24 Domain Check plugin page on WordPress.org for the latest release and the VulnCheck Security Advisory for remediation status. Until a fixed version is confirmed, removing the plugin is the recommended action.

Workarounds

Remove the WP24 Domain Check plugin and replace it with a maintained alternative that performs domain checks
Deploy a web application firewall rule that blocks script tags and JavaScript event-handler attributes in POST data submitted to options.php
Limit the WordPress administrator role to a minimal set of trusted accounts and enforce multi-factor authentication on those accounts
Apply Content Security Policy (CSP) headers in the WordPress admin context to restrict inline script execution

bash

# Example CSP header for WordPress admin (adjust to environment)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"