CVE-2024-10869: WordPress Brute Force Protection XSS Flaw

CVE-2024-10869 Overview

CVE-2024-10869 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WordPress Brute Force Protection – Stop Brute Force Attacks plugin (GuardGiant). The flaw affects all versions up to and including 2.2.6. It stems from the use of add_query_arg and remove_query_arg without proper URL escaping in the login activity log component. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a victim's browser session, enabling credential theft, session hijacking, or administrative action abuse when an authenticated WordPress user follows a malicious link.

Affected Products

WordPress Brute Force Protection – Stop Brute Force Attacks (GuardGiant) plugin versions ≤ 2.2.6
WordPress sites with the vulnerable plugin installed and activated
Administrator sessions accessing the login activity log page

Discovery Timeline

2024-11-23 - CVE-2024-10869 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10869

Vulnerability Analysis

The vulnerability resides in class-guardgiant-table-login-activity-log.php at lines 483 and 491. The plugin passes user-controllable URL parameters to WordPress's add_query_arg and remove_query_arg functions and reflects the resulting URL back into rendered HTML without escaping. Because these WordPress helper functions do not sanitize input on their own, unsanitized query string data flows directly into the page output. An attacker crafts a URL containing a malicious payload in a query parameter. When an authenticated user visits the crafted URL, the payload executes in the browser under the site's origin.

Root Cause

The root cause is missing output encoding on reflected URL data. The plugin relies on add_query_arg and remove_query_arg to build navigation links but omits esc_url or esc_attr on the output. WordPress documentation explicitly warns that these functions do not escape their output and require the developer to apply escaping.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted link through phishing, forum posts, or embedded content. A logged-in WordPress user accessing the GuardGiant login activity log page with the malicious query string triggers script execution. See the Wordfence Vulnerability Report and the WordPress GuardGiant Plugin Code for the affected code paths.

Detection Methods for CVE-2024-10869

Indicators of Compromise

Web server access logs containing suspicious query parameters with <script>, javascript:, onerror=, or URL-encoded equivalents targeting GuardGiant admin pages
Referrer headers from external sources leading directly to /wp-admin/ pages associated with the GuardGiant plugin
Unexpected administrative actions performed shortly after an admin clicked an external link

Detection Strategies

Inspect HTTP request logs for encoded XSS payloads in query strings targeting GuardGiant admin views
Deploy Content Security Policy (CSP) headers and monitor report-uri endpoints for inline script violations
Correlate authenticated admin sessions with anomalous outbound requests originating from the WordPress admin interface

Monitoring Recommendations

Enable WordPress audit logging for administrator activity and plugin page access
Monitor for plugin version strings in HTTP responses to identify installations still running GuardGiant ≤ 2.2.6
Alert on browser-side JavaScript errors or CSP violations reported from /wp-admin/ origins

How to Mitigate CVE-2024-10869

Immediate Actions Required

Update the WordPress Brute Force Protection – Stop Brute Force Attacks plugin to a version above 2.2.6, if available from the vendor
If no patched version is available, deactivate and remove the GuardGiant plugin
Instruct administrators to avoid clicking untrusted links while logged into WordPress

Patch Information

Review the plugin's changelog on the WordPress.org plugin repository for a release addressing the missing output escaping on add_query_arg and remove_query_arg calls in class-guardgiant-table-login-activity-log.php. Confirm the fix by inspecting lines 483 and 491 for esc_url wrapping.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript URI schemes in query parameters targeting wp-admin GuardGiant pages
Enforce a strict Content Security Policy that disallows inline scripts on the WordPress admin interface
Restrict access to the WordPress admin area by IP allowlist to reduce phishing-based exploitation risk

bash

# Example nginx rule to block common reflected XSS payloads on GuardGiant admin pages
location ~* /wp-admin/.*guardgiant.* {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}