CVE-2024-10877: Advanced Form Integration XSS Vulnerability

CVE-2024-10877 Overview

CVE-2024-10877 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Advanced Form Integration (AFI) plugin for WordPress. The flaw affects all versions up to and including 1.92.0. It stems from unsafe use of the WordPress add_query_arg() and remove_query_arg() functions without proper output escaping on URL parameters. Unauthenticated attackers can craft malicious URLs that inject arbitrary JavaScript into rendered pages. Exploitation requires a victim to click a crafted link, at which point the injected script executes in the victim's browser session.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated user's browser, potentially leading to session theft, administrative action abuse, or redirection to attacker-controlled resources.

Affected Products

Advanced Form Integration (AFI) plugin for WordPress
All versions up to and including 1.92.0
Vulnerable file: includes/class-adfoin-log-table.php

Discovery Timeline

2024-11-13 - CVE-2024-10877 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10877

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified under CWE-79. It exists in the plugin's log table rendering logic located in includes/class-adfoin-log-table.php. The plugin builds pagination and filter URLs by passing user-controlled request parameters into add_query_arg() and remove_query_arg() and then outputting the resulting URLs directly into HTML without escaping. Because these WordPress helper functions do not sanitize input, attacker-controlled query string values are reflected back into the page unmodified. When a victim clicks a crafted link, the malicious payload renders inside the DOM and executes in the browser context of the current WordPress session.

Root Cause

The root cause is missing output encoding on URLs constructed with add_query_arg() and remove_query_arg(). Developers commonly assume these functions perform sanitization, but they do not. Any query parameter the attacker controls is reflected verbatim into the generated URL string, which is then written to the page without an escaping wrapper such as esc_url() or esc_attr().

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL targeting a page rendered by the vulnerable plugin, embeds a malicious payload in a query parameter, and delivers the link to a WordPress administrator or logged-in user. When the target clicks the link, the payload executes in their browser under the origin of the WordPress site. The scope is changed, meaning script execution can affect resources beyond the vulnerable component itself, including authenticated admin actions. See the Wordfence Vulnerability Report for the vulnerable code path.

Detection Methods for CVE-2024-10877

Indicators of Compromise

Web server access logs containing requests to WordPress admin pages with suspicious query string values, including URL-encoded <script>, onerror=, javascript:, or %3Cscript%3E patterns.
Referrer headers pointing to external phishing or link-shortener domains directing traffic to /wp-admin/ pages tied to the AFI plugin.
Unexpected administrative actions performed shortly after an admin followed an external link.

Detection Strategies

Inspect HTTP request logs for query parameters containing HTML tags, event handlers, or encoded script fragments targeting AFI plugin URLs.
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS payloads in query strings on WordPress admin routes.
Correlate admin session activity with click-through referrers to identify social-engineered exploitation attempts.

Monitoring Recommendations

Enable WordPress audit logging for administrator activity and plugin configuration changes.
Monitor endpoint browser telemetry on administrator workstations for anomalous script execution originating from the WordPress origin.
Alert on outbound requests from admin browsers to newly registered or uncategorized domains immediately following WordPress dashboard access.

How to Mitigate CVE-2024-10877

Immediate Actions Required

Update the Advanced Form Integration plugin to a version later than 1.92.0 that includes the fix from changeset 3185778.
Audit WordPress administrator accounts and force password rotation and session invalidation for users who may have clicked untrusted links.
Restrict /wp-admin/ access to known IP ranges where feasible to reduce the attack surface for reflected XSS delivery.

Patch Information

The vendor addressed the vulnerability in changeset 3185778 for the class-adfoin-log-table.php file. Review the fix in the WordPress Plugin Changeset. Administrators should upgrade to the latest available release from the WordPress plugin repository.

Workarounds

Temporarily deactivate the Advanced Form Integration plugin until the patched version is deployed.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to limit the impact of reflected XSS payloads.
Deploy WAF signatures that block query parameters containing HTML tags or JavaScript event handlers on WordPress admin endpoints.

bash

# Example: update the plugin via WP-CLI
wp plugin update advanced-form-integration

# Verify the installed version is above 1.92.0
wp plugin get advanced-form-integration --field=version