CVE-2024-11204: ForumWP WordPress Plugin XSS Vulnerability

CVE-2024-11204 Overview

The ForumWP – Forum & Discussion Board plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the url parameter. The flaw affects all versions up to and including 2.1.2 and stems from insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can craft malicious links that execute arbitrary JavaScript in a victim's browser when clicked. Successful exploitation requires user interaction, limiting mass exploitation but enabling targeted phishing and session hijacking against WordPress administrators.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling cookie theft, session hijacking, and administrative action forgery when an authenticated user clicks a crafted link.

Affected Products

Ultimate Member ForumWP (Free) for WordPress — all versions through 2.1.2
Ultimate Member ForumWP (Pro) for WordPress — all versions through 2.1.2
WordPress sites with the ForumWP plugin installed and active

Discovery Timeline

2024-12-06 - CVE-2024-11204 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11204

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw located in the administrative columns handling code of the ForumWP plugin. The affected logic is referenced in includes/admin/class-columns.php around line 313 in the 2.1.1 release tag. Attacker-controlled data supplied via the url request parameter is reflected back into the rendered page without adequate sanitization or escaping. When the response is rendered in a browser, injected markup executes in the context of the WordPress site's origin.

Because the vector is reflected and requires user interaction, exploitation typically relies on phishing. If the targeted user holds an authenticated administrator session, the attacker can leverage the browser to create new users, modify plugin settings, or exfiltrate nonces to perform further privileged actions.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin accepts the url parameter and emits its value into HTML output without passing it through WordPress sanitization helpers such as esc_url(), esc_attr(), or esc_html(). Fix commits appear in the plugin changeset 3205107 on the trunk branch of class-columns.php.

Attack Vector

Exploitation is network-based and requires no authentication, but it does require the victim to click or load an attacker-crafted URL containing a payload in the url parameter. An attacker delivers the link via email, social media, or a compromised site. Upon loading, the injected script executes under the WordPress site origin and can access cookies, local storage, and the DOM. Scope is changed, meaning the injected script can impact resources beyond the vulnerable component, including the WordPress admin interface.

See the Wordfence Vulnerability Report and the WordPress Plugin Code File for the vulnerable code path.

Detection Methods for CVE-2024-11204

Indicators of Compromise

Inbound HTTP GET requests to WordPress endpoints containing url= parameters with URL-encoded <script>, javascript:, onerror=, or onload= tokens.
Web server access logs showing referrers from untrusted domains linking to ForumWP admin pages with abnormally long url query strings.
Unexpected WordPress administrator account creation, nonce usage, or plugin configuration changes shortly after an admin clicked an external link.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings for script-tag patterns and HTML event handlers in requests targeting the ForumWP plugin.
Correlate web access logs with WordPress audit logs to identify sessions where XSS-shaped query strings precede privileged administrative actions.
Enforce and monitor a strict Content Security Policy (CSP) that blocks inline script execution, and alert on CSP violation reports originating from ForumWP admin pages.

Monitoring Recommendations

Monitor the installed version of the ForumWP plugin across all managed WordPress sites and alert on any instance at or below 2.1.2.
Track outbound HTTP requests from administrator browsers to unknown domains, which may indicate stolen session data exfiltration.
Review WordPress role and capability changes, API token generation, and new administrator accounts on a daily cadence.

How to Mitigate CVE-2024-11204

Immediate Actions Required

Upgrade the ForumWP plugin to a version later than 2.1.2 on every WordPress installation.
Audit administrator and editor accounts for unauthorized creation or privilege changes since early December 2024.
Rotate WordPress administrator passwords and invalidate active sessions after patching.
Enable multi-factor authentication for all privileged WordPress accounts to reduce the impact of session compromise.

Patch Information

The vendor addressed the vulnerability in the trunk branch under changeset 3205107 to includes/admin/class-columns.php. Site operators should install the latest release available via the WordPress plugin repository. Reference the WordPress Plugin Changeset and the ForumWP Developer Page for release details.

Workarounds

If immediate patching is not possible, deactivate the ForumWP plugin until an upgrade can be deployed.
Deploy WAF signatures blocking HTML and JavaScript payloads in the url query parameter for WordPress admin paths.
Enforce a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Train administrators to avoid clicking unsolicited links to their own WordPress site and to access the admin dashboard only through bookmarks.

bash

# Example WAF rule (ModSecurity) blocking script payloads in the 'url' parameter
SecRule ARGS:url "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<iframe)" \
    "id:1024110204,phase:2,deny,status:403,log,\
    msg:'CVE-2024-11204 ForumWP Reflected XSS attempt in url parameter'"