CVE-2024-10880 Overview
CVE-2024-10880 is a Reflected Cross-Site Scripting (XSS) vulnerability in the JobBoardWP – Job Board Listings and Submissions plugin for WordPress, developed by Ultimatemember. The flaw affects all versions up to and including 1.3.0. The root cause is the use of add_query_arg and remove_query_arg without appropriate URL escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is tracked under CWE-79.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and administrative action abuse when an authenticated user is tricked into clicking a malicious link.
Affected Products
- Ultimatemember JobBoardWP plugin for WordPress, versions ≤ 1.3.0
- WordPress sites running the vulnerable plugin on any underlying WordPress core version
- Administrative pages rendered by class-emails-list-table.php in the plugin
Discovery Timeline
- 2024-11-23 - CVE-2024-10880 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10880
Vulnerability Analysis
The JobBoardWP plugin builds administrative URLs using the WordPress helper functions add_query_arg and remove_query_arg. Both functions return the current request URI with query parameters appended or removed, but they do not sanitize or escape the returned value. When the resulting URL is echoed back into HTML without passing through esc_url or an equivalent escaping routine, any attacker-controlled portion of the request becomes reflected content.
Technical references point to the plugin file includes/admin/class-emails-list-table.php at lines 168 and 192, where the unsafe URL construction occurs. Exploitation requires user interaction, specifically an authenticated user clicking a crafted link. Because the scope changes from the vulnerable component to the browser context, the resulting script runs with the privileges of the authenticated session.
Root Cause
The vulnerability stems from improper neutralization of input during web page generation ([CWE-79]). The plugin trusts the output of add_query_arg and remove_query_arg, which pass through unescaped request data. Without wrapping these calls in esc_url before output, arbitrary attributes and script payloads survive into the rendered DOM.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts a URL to a vulnerable JobBoardWP admin page with a malicious payload in a query string parameter. The attacker delivers the link through phishing, social engineering, or malicious web content. When an authenticated WordPress administrator or editor clicks the link, the injected script executes in their browser against the WordPress origin.
No verified public exploit code is available for this vulnerability. See the Wordfence Vulnerability Analysis and the WordPress JobBoardWP Code Snippet for technical details of the vulnerable call sites.
Detection Methods for CVE-2024-10880
Indicators of Compromise
- Web server access logs showing requests to JobBoardWP admin endpoints with suspicious query strings containing <script>, javascript:, onerror=, or percent-encoded equivalents
- Referer headers pointing to external domains preceding administrative actions in the WordPress dashboard
- Unexpected changes to WordPress user accounts, plugin settings, or new administrator creation shortly after a user clicked an external link
Detection Strategies
- Inspect HTTP request logs for query parameters sent to JobBoardWP admin pages that contain HTML tags, event handlers, or URL-encoded script fragments
- Deploy a Web Application Firewall (WAF) rule set that identifies reflected XSS patterns against WordPress admin URIs
- Review browser Content Security Policy (CSP) violation reports for script-src blocks originating from WordPress admin pages
Monitoring Recommendations
- Monitor WordPress audit logs for administrative actions that occur immediately after an admin session loads a request with abnormal query parameters
- Alert on JobBoardWP plugin versions ≤ 1.3.0 across managed WordPress inventories
- Baseline normal query string shapes for JobBoardWP admin pages and alert on deviations such as unusually long parameters or encoded tags
How to Mitigate CVE-2024-10880
Immediate Actions Required
- Update the JobBoardWP plugin to a version later than 1.3.0 that incorporates the fix from the vendor changeset
- Audit active WordPress sites for the presence of JobBoardWP and prioritize patching sites that expose the admin dashboard to shared or multi-user environments
- Instruct administrators and editors to avoid clicking external links while authenticated to the WordPress admin dashboard until patching is complete
Patch Information
The vendor addressed the issue in the WordPress plugin repository. Review the WordPress JobBoardWP Changeset to confirm the fix, which wraps the affected add_query_arg and remove_query_arg output with proper URL escaping. Apply the update through the WordPress plugin manager or by replacing the plugin files from the official distribution.
Workarounds
- Deactivate the JobBoardWP plugin until it can be updated if the admin workflow permits
- Restrict access to /wp-admin/ using IP allow-listing or VPN requirements to reduce the exposure of authenticated sessions to crafted links
- Enforce a strict Content Security Policy that disallows inline script execution on WordPress admin pages to reduce the impact of reflected XSS payloads
# Example: WordPress WP-CLI command to update JobBoardWP to the latest patched version
wp plugin update jobboardwp --version=latest
# Verify installed version is greater than 1.3.0
wp plugin get jobboardwp --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
