CVE-2024-10792 Overview
CVE-2024-10792 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WPFunnels plugin for WordPress, marketed as "The Easiest Funnel Builder For WordPress & WooCommerce." The flaw affects all plugin versions up to and including 3.5.5 and stems from insufficient input sanitization and output escaping on the post_id parameter. Unauthenticated attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when clicked. The issue was partially patched in version 3.5.4 and fully patched in 3.5.5. It is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can hijack authenticated administrator sessions, perform actions in the site owner's context, and pivot to further site compromise if a target clicks a crafted link.
Affected Products
- WPFunnels plugin for WordPress — all versions up to and including 3.5.5
- WordPress sites using the vulnerable Oxygen optin widget template (template-optin.php)
- WooCommerce stores relying on WPFunnels for funnel-based sales flows
Discovery Timeline
- 2024-11-21 - CVE-2024-10792 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10792
Vulnerability Analysis
The vulnerability resides in the WPFunnels Oxygen optin widget template file template-optin.php. The plugin reads the post_id request parameter and reflects it into rendered HTML without applying WordPress sanitization functions such as esc_attr(), esc_html(), or absint(). Because the parameter is reachable without authentication, any visitor to a WordPress site running WPFunnels can trigger the sink by clicking a crafted URL.
Reflected XSS requires user interaction, which is why the attack complexity remains network-based but user-triggered. An attacker typically distributes the malicious link through phishing emails, social media, or malicious ad placements. When an authenticated administrator clicks the link, the injected script runs in the site's origin and inherits the administrator's session privileges. This enables account takeover, creation of new admin users, plugin installation, and content modification.
Root Cause
The root cause is missing input validation and output encoding on the post_id parameter within the plugin's Oxygen builder integration. The plugin treats the incoming value as trusted and injects it directly into HTML output, violating WordPress secure coding standards for reflected request data. The fix applied in changeset 3193046 introduces proper escaping to neutralize embedded HTML control characters.
Attack Vector
Exploitation requires an unauthenticated attacker to deliver a crafted URL to a target who has an active WordPress session or who visits the vulnerable page. The URL includes a JavaScript payload in the post_id query parameter. Once loaded, the browser parses the reflected payload as executable script within the site's document context. Because the scope is changed (S:C), the attacker can access resources beyond the vulnerable component, such as cookies and DOM elements belonging to the WordPress admin interface.
No public proof-of-concept exploit or exploitation-in-the-wild has been documented. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset 3193046 for the technical fix details.
Detection Methods for CVE-2024-10792
Indicators of Compromise
- Web server access logs showing requests to WPFunnels endpoints with post_id values containing HTML tags, <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
- Unexpected creation of WordPress administrator accounts or plugin installations following administrator clicks on external links.
- Referer headers pointing to unfamiliar phishing domains for requests hitting the WPFunnels optin template.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect the post_id query parameter for script tags, event handlers, and encoded XSS payloads.
- Correlate WordPress audit logs with web request logs to identify session activity that immediately follows suspicious post_id requests.
- Perform version auditing across WordPress deployments to flag any WPFunnels installation at or below version 3.5.5.
Monitoring Recommendations
- Enable verbose HTTP request logging on WordPress front-end servers and forward the logs to a centralized SIEM for query and alerting.
- Alert on administrator-role changes, new user creation, and plugin file writes on hosts running WPFunnels.
- Monitor outbound requests from browsers of WordPress administrators for connections to attacker-controlled callback domains.
How to Mitigate CVE-2024-10792
Immediate Actions Required
- Upgrade WPFunnels to version 3.5.5 or later on every WordPress site where it is installed.
- Audit administrator accounts and installed plugins for unauthorized changes made after the vulnerability window opened.
- Force password rotation and session invalidation for all WordPress administrator accounts if suspicious post_id requests appear in logs.
Patch Information
The vendor released a partial fix in WPFunnels 3.5.4 and a full fix in version 3.5.5. The corrective code is available in WordPress Plugin Changeset 3193046, which adds proper escaping to the reflected post_id value inside template-optin.php. Review the WordPress Plugin Template Code to confirm the patched routine is present in your deployment.
Workarounds
- Deactivate the WPFunnels plugin until the site can be upgraded to version 3.5.5 or later.
- Configure a WAF rule to block or sanitize requests containing HTML metacharacters in the post_id parameter targeting WPFunnels URLs.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WordPress admin and funnel pages to limit payload execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.