CVE-2024-10522: WordPress Co-marquage Plugin XSS Vulnerability

CVE-2024-10522 Overview

The Co-marquage service-public.fr plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 0.5.76. The flaw stems from the use of add_query_arg without proper escaping on the URL within includes/admin/notices.class.php. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, or administrative action abuse if the victim holds a privileged WordPress role.

Affected Products

Co-marquage service-public.fr WordPress plugin — all versions through 0.5.76
WordPress sites running the vulnerable plugin with the admin notices component enabled
Any environment where administrators or editors can be lured to interact with attacker-controlled links

Discovery Timeline

2024-11-21 - CVE-2024-10522 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10522

Vulnerability Analysis

The plugin builds URLs for administrative notices using the WordPress helper add_query_arg. When called without an explicit URL argument, add_query_arg reuses the current request URI, which is derived from user-controlled input. If the returned string is echoed into HTML without escaping through functions such as esc_url, attacker-supplied content in the query string reaches the DOM unfiltered.

This pattern is a well-documented reflected XSS sink in WordPress plugins. The referenced source line in notices.class.php#L37 shows the unsanitized use of the constructed URL. The changeset 3192977 in the plugin repository addresses the sink by applying output escaping.

Exploitation requires user interaction: the target must click a crafted link pointing at the vulnerable WordPress admin page. No authentication is needed to craft the payload, though the reflected script executes in the context of whoever loads it.

Root Cause

The root cause is missing output escaping on a reflected URL parameter. add_query_arg preserves query-string data from the current request, and the plugin passes the result directly into rendered HTML. Without wrapping the value in esc_url or esc_attr, an attacker can break out of the intended attribute context and inject <script> payloads.

Attack Vector

An attacker crafts a URL pointing to an administrative page of the vulnerable WordPress site, embedding JavaScript within a query parameter that the plugin later reflects. The attacker delivers the link through phishing, social media, or comment injection. When a signed-in administrator clicks the link, the script executes in the admin's browser under the site's origin, allowing account takeover actions such as creating new administrative users or planting persistent backdoors through theme or plugin editing.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the affected source location.

Detection Methods for CVE-2024-10522

Indicators of Compromise

HTTP requests to WordPress admin pages containing script tags, javascript: URIs, or HTML entities inside query parameters such as page, tab, or notice.
Referrer logs showing external inbound clicks to /wp-admin/ URLs with unusual query strings.
New WordPress administrator accounts, modified theme files, or unexpected plugin installations following an admin session that clicked an inbound link.

Detection Strategies

Inspect web server access logs for URL-encoded payloads (%3Cscript%3E, onerror=, onload=) targeting admin endpoints of the Co-marquage plugin.
Deploy a web application firewall rule to flag reflected XSS patterns in requests to /wp-admin/admin.php when the page parameter references the plugin.
Enable WordPress audit logging to correlate admin actions with the preceding request's referrer and query string.

Monitoring Recommendations

Monitor for creation of privileged users, file modifications under wp-content/, and unscheduled plugin or theme changes.
Alert on outbound requests from the WordPress host to unknown domains, which may indicate stolen cookies or beaconing from injected scripts.
Track browser Content Security Policy (CSP) violation reports to identify blocked inline scripts on administrative pages.

How to Mitigate CVE-2024-10522

Immediate Actions Required

Update the Co-marquage service-public.fr plugin to a version later than 0.5.76 that includes changeset 3192977.
If an updated release is not yet available in the WordPress plugin repository, deactivate and remove the plugin until a fix is confirmed.
Force-invalidate active WordPress sessions and rotate administrator passwords if suspicious inbound links to admin pages appear in logs.

Patch Information

The vendor fix is recorded in WordPress Plugin Change Log — changeset 3192977, which adds output escaping to the affected notices.class.php code path. Confirm the installed plugin version reflects the patched build via the WordPress Plugin Developer Info page.

Workarounds

Restrict access to /wp-admin/ by source IP using web server or reverse proxy rules to reduce exposure of administrators to untrusted links.
Deploy a Content Security Policy that disallows inline scripts and restricts script sources, blunting reflected XSS payloads.
Train administrators to avoid clicking unsolicited links to their own WordPress admin console and to verify URLs before authenticating.

bash

# Example nginx CSP header to mitigate reflected XSS on WordPress admin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;