CVE-2024-10825: Hide My WP Ghost XSS Vulnerability

CVE-2024-10825 Overview

CVE-2024-10825 is a reflected cross-site scripting (XSS) vulnerability in the Hide My WP Ghost – Security & Firewall plugin for WordPress. The flaw affects all plugin versions up to and including 5.3.01. The plugin fails to properly sanitize input and escape output from the URL, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. Successful exploitation requires user interaction, typically targeting authenticated administrators. The vulnerability is tracked under CWE-79 and was patched in changeset 3186489 on the WordPress plugin repository.

Critical Impact
Attackers can execute arbitrary scripts in an administrator's browser session, enabling account takeover, privilege abuse, or injection of malicious content into WordPress site pages.

Affected Products

Hide My WP Ghost – Security & Firewall plugin for WordPress
All versions up to and including 5.3.01
Vendor: wpplugins

Discovery Timeline

2024-11-15 - CVE-2024-10825 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10825

Vulnerability Analysis

The vulnerability resides in the Tools.php class of the Hide My WP Ghost plugin. Specifically, the code at lines 633 and 638 processes URL data without applying adequate sanitization or output escaping. When a victim visits a URL containing attacker-controlled payload, the plugin reflects that payload back into the rendered page. The browser then interprets the injected content as executable script.

Reflected XSS in a WordPress security plugin is particularly consequential. The plugin is installed on sites that specifically seek hardening, and any successful payload execution in an administrator context can bypass those hardening controls. The attacker can steal session cookies, perform actions as the administrator, or pivot to plant persistent backdoors through the WordPress admin interface.

Root Cause

The root cause is missing input sanitization and missing output escaping on data derived from the request URL. WordPress provides helper functions such as esc_url(), esc_html(), esc_attr(), and sanitize_text_field() for exactly this purpose. The affected code paths did not apply these controls before echoing URL-derived data into the response.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker crafts a URL containing an XSS payload targeting the vulnerable parameter handled by Tools.php. The attacker then distributes the link through phishing email, social media, or a compromised site. When a logged-in administrator clicks the link, the payload executes in their browser under the origin of the WordPress site. Refer to the Wordfence Vulnerability Report and the vulnerable Tools.php source for technical details.

Detection Methods for CVE-2024-10825

Indicators of Compromise

Web server access logs containing URL parameters with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E directed at WordPress endpoints.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking an inbound link.
Creation of new WordPress administrator accounts, plugin installations, or theme edits that do not correlate with legitimate admin activity.

Detection Strategies

Inventory WordPress installations and identify sites running Hide My WP Ghost at version 5.3.01 or earlier.
Deploy web application firewall rules to identify script tags, event handlers, and JavaScript URIs in query strings targeting plugin endpoints.
Correlate referrer headers on admin actions to catch requests initiated from external or suspicious origins.

Monitoring Recommendations

Enable and centralize WordPress audit logs to capture administrator actions, plugin changes, and user creations.
Monitor endpoint browser telemetry on administrator workstations for anomalous script execution or credential exfiltration attempts.
Alert on modifications to wp-config.php, theme files, or plugin files following administrator sessions.

How to Mitigate CVE-2024-10825

Immediate Actions Required

Update the Hide My WP Ghost plugin to a version newer than 5.3.01 that includes the fix from changeset 3186489.
Force password resets and invalidate active sessions for all WordPress administrator accounts.
Review recent administrator activity, installed plugins, and user accounts for signs of unauthorized changes.

Patch Information

The vendor addressed the vulnerability in changeset 3186489, which corrects the input handling in Tools.php. Administrators should install the patched release through the WordPress plugin dashboard or via wp-cli.

Workarounds

Deactivate the Hide My WP Ghost plugin until the patched version is applied.
Deploy a web application firewall rule that blocks requests containing common XSS payload signatures in query parameters.
Enforce Content Security Policy (CSP) headers that restrict inline script execution on the WordPress site.

bash

# Update Hide My WP Ghost via wp-cli
wp plugin update hide-my-wp --version=latest

# Verify installed version is above 5.3.01
wp plugin get hide-my-wp --field=version

# If patch cannot be applied immediately, deactivate the plugin
wp plugin deactivate hide-my-wp