CVE-2024-11377: WordPress Automate Hub Plugin XSS Flaw

CVE-2024-11377 Overview

CVE-2024-11377 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Automate Hub Free by Sperse.IO plugin for WordPress. The flaw affects all versions up to and including 1.7.0. The root cause is insufficient input sanitization and output escaping of the id parameter across multiple integration endpoints. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on January 7, 2025.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a targeted WordPress user's session, enabling session theft, credential capture, and administrative account takeover through social engineering.

Affected Products

Automate Hub Free by Sperse.IO plugin for WordPress, versions up to and including 1.7.0
Vulnerable integration modules include clickup.php, encharge.php, getgist.php, googlecontact.php, mailchimp.php, and teamwork.php
WordPress sites exposing the affected plugin endpoints to unauthenticated visitors

Discovery Timeline

2025-01-07 - CVE-2024-11377 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11377

Vulnerability Analysis

The vulnerability is a classic Reflected XSS issue. The plugin reads the id query parameter from incoming HTTP requests and reflects the value back into rendered HTML output. The affected code paths in clickup.php, encharge.php, getgist.php, googlecontact.php, mailchimp.php, and teamwork.php do not apply WordPress sanitization primitives such as sanitize_text_field() on input, and they do not escape output using functions like esc_html(), esc_attr(), or esc_url(). As a result, attacker-controlled markup, including <script> tags and inline event handlers, is delivered verbatim to the browser and executed within the origin of the WordPress site.

Execution occurs in the security context of whoever visits the crafted URL. When the victim is an authenticated administrator, the injected script inherits session cookies and can perform privileged actions on their behalf, including creating new administrator accounts or modifying plugin configuration.

Root Cause

The root cause is missing input validation and missing output encoding on the id request parameter in the plugin's integration handlers. See the vulnerable line references in clickup.php, encharge.php, getgist.php, googlecontact.php, mailchimp.php, and teamwork.php.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL targeting a vulnerable plugin endpoint with a malicious payload in the id parameter, then delivers the link through phishing, malvertising, forum posts, or social media. When a WordPress site user or administrator loads the URL, the injected script executes in their browser. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-11377

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/automate-hub-free-by-sperse-io/apps/ containing id parameter values with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
Web server access logs showing crafted URLs referencing clickup.php, encharge.php, getgist.php, googlecontact.php, mailchimp.php, or teamwork.php with unusually long or encoded id values
New administrator accounts, plugin installations, or theme file modifications following a click on an external link containing the plugin path

Detection Strategies

Deploy web application firewall (WAF) rules that match XSS payload signatures against query strings targeting the affected plugin paths
Correlate referrer and user-agent data with suspicious id parameter contents in WordPress access logs
Alert on outbound requests from browsers to attacker infrastructure immediately following a request to the vulnerable plugin endpoints

Monitoring Recommendations

Ingest WordPress access and PHP error logs into a centralized analytics platform and search for reflected payload patterns in the id parameter
Monitor WordPress audit logs for unexpected privilege changes, user creation events, and plugin or theme modifications
Track browser telemetry for script execution originating from the vulnerable plugin URL paths

How to Mitigate CVE-2024-11377

Immediate Actions Required

Deactivate and remove the Automate Hub Free by Sperse.IO plugin if a patched version is not available or not required
Restrict access to /wp-content/plugins/automate-hub-free-by-sperse-io/ at the WAF or reverse proxy layer until remediation is confirmed
Force password resets for administrator accounts that may have loaded suspicious links targeting the plugin endpoints

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.7.0. Consult the plugin's WordPress.org listing and the Wordfence advisory for the most current fixed-version information before returning the plugin to service.

Workarounds

Block requests containing suspicious characters in the id parameter (for example <, >, ", ', and their URL-encoded forms) at the WAF
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources to reduce the impact of reflected XSS
Limit plugin endpoint accessibility to authenticated administrators via server-level access controls where feasible

bash

# Example ModSecurity rule to block XSS payloads in the id parameter
SecRule REQUEST_URI "@contains /wp-content/plugins/automate-hub-free-by-sperse-io/" \
    "chain,id:1011377,phase:2,deny,status:403,log,msg:'CVE-2024-11377 Reflected XSS attempt'"
    SecRule ARGS:id "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
        "t:none,t:urlDecodeUni"