CVE-2024-10647: WS Form WordPress Plugin XSS Vulnerability

CVE-2024-10647 Overview

CVE-2024-10647 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.9.244. The root cause is the use of remove_query_arg without proper URL escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires user interaction, such as clicking a crafted link. Successful attacks execute attacker-controlled JavaScript in the victim's browser session on the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser when the victim clicks a malicious link, potentially leading to session hijacking or administrative action abuse.

Affected Products

WS Form LITE – Drag & Drop Contact Form Builder for WordPress (versions ≤ 1.9.244)
Vendor: Westguardsolutions
Deployment: WordPress sites running the LITE plugin edition

Discovery Timeline

2024-11-06 - CVE-2024-10647 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10647

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) issue classified under [CWE-79]. It stems from the plugin's handling of URL parameters through the WordPress remove_query_arg function. The function strips a specified parameter from the current URL but does not sanitize or escape the remaining URL contents when echoed back into the page.

Attackers craft a URL containing malicious script content in query parameters. When a logged-in or anonymous user visits the crafted URL, the plugin reflects the unescaped URL into the DOM. The browser then parses and executes the attacker-supplied script in the site's origin.

Because the exploit requires only user interaction and no authentication, mass phishing or targeted link delivery against administrators represent the primary attack scenarios. Successful execution against an administrator can lead to session theft, forced plugin configuration changes, or pivoting into further site compromise.

Root Cause

The plugin invokes remove_query_arg to strip a parameter from the request URL and renders the resulting URL back into the page without passing it through esc_url or an equivalent escaping routine. This is a well-documented insecure usage pattern in WordPress plugins, covered in the official WordPress developer guidance.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to a victim who has access to a site running the vulnerable plugin. The attack is network-reachable, requires no privileges, and executes within the scope of the vulnerable WordPress origin. See the Wordfence Vulnerability Report for the technical write-up.

// No verified public exploit code is available for CVE-2024-10647.
// Refer to the Wordfence advisory for technical details.

Detection Methods for CVE-2024-10647

Indicators of Compromise

Web server access logs showing requests to WordPress pages hosting WS Form with query strings containing <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Referer headers originating from external sites or URL shorteners immediately preceding administrator session anomalies.
Unexpected modifications to WordPress users, options, or plugin settings shortly after an administrator clicks an external link.

Detection Strategies

Inventory WordPress deployments and identify installations of WS Form LITE at version 1.9.244 or earlier.
Deploy a Web Application Firewall (WAF) ruleset for reflected XSS patterns targeting WordPress query parameters.
Review browser console logs and Content Security Policy (CSP) violation reports from administrator workstations for script-source violations.

Monitoring Recommendations

Alert on HTTP requests to WordPress endpoints containing script tags or JavaScript URI schemes in query strings.
Monitor administrator account activity for session reuse from unexpected IP addresses following link clicks.
Correlate email gateway telemetry with web proxy logs to identify delivered phishing URLs targeting WordPress administrators.

How to Mitigate CVE-2024-10647

Immediate Actions Required

Update WS Form LITE to a version later than 1.9.244 on all WordPress installations.
Audit recent administrator sessions and plugin configuration changes for signs of abuse.
Train WordPress administrators to avoid clicking unsolicited links while authenticated to the admin dashboard.

Patch Information

The vendor addressed the issue in the plugin changeset published to the WordPress plugin repository. Review the WordPress Plugin Changeset for the specific code change that applies escaping to the URL returned by remove_query_arg.

Workarounds

Deactivate and remove WS Form LITE until the patched version is deployed if immediate updating is not possible.
Enforce a strict Content Security Policy on the WordPress site to limit inline script execution.
Restrict administrator access to a trusted network segment or require VPN access to the /wp-admin/ path.

bash

# Example WP-CLI command to update the plugin to the latest version
wp plugin update ws-form --path=/var/www/html

# Verify installed version
wp plugin get ws-form --field=version --path=/var/www/html