CVE-2024-11379: WordPress Broadcast Plugin XSS Vulnerability

CVE-2024-11379 Overview

The Broadcast plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the do_check parameter. The flaw affects all versions up to and including 51.01 and stems from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The vulnerability only impacts multi-site WordPress installations. The issue was addressed in a plugin changeset published on the WordPress plugin repository.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the victim's browser session, enabling session theft, administrative action abuse, and content manipulation on affected WordPress multi-site installations.

Affected Products

Broadcast (threewp-broadcast) plugin for WordPress, versions up to and including 51.01
WordPress multi-site installations only
Single-site WordPress deployments are not affected

Discovery Timeline

2024-12-06 - CVE-2024-11379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11379

Vulnerability Analysis

The Broadcast plugin's maintenance controller processes the do_check request parameter without adequately sanitizing input or escaping output. Attacker-controlled data reaches the rendered response, allowing script injection through a crafted URL. Because the flaw is reflected, exploitation requires user interaction such as clicking a malicious link. Successful execution runs attacker JavaScript in the context of the vulnerable site.

The scope change indicated by the CVSS vector reflects the multi-site context. Injected script executes in the trust boundary of the network's administrative interface, expanding potential impact beyond the initially requested component. Confidentiality and integrity impacts are limited to what the victim's session can access.

Root Cause

The root cause is missing input sanitization and output escaping in the maintenance controller located at src/maintenance/controller.php. The do_check parameter value is echoed back into the response without being passed through WordPress escaping helpers such as esc_html() or esc_attr(). This CWE-79 pattern is a canonical reflected XSS defect.

Attack Vector

An attacker crafts a URL targeting the vulnerable maintenance endpoint on a WordPress multi-site installation running the Broadcast plugin. The URL embeds JavaScript payload data in the do_check query parameter. The attacker delivers the link through phishing, forum posts, or third-party sites. When an authenticated multi-site administrator opens the link, the injected script executes in the browser and can perform actions on behalf of the victim, exfiltrate session cookies, or manipulate rendered content.

Because exploitation is reflected, the payload is not stored server-side. No authentication is required to craft the malicious URL, but user interaction is required for execution. See the WordPress Plugin Code Review for the pre-fix source and the WordPress Changeset Update for the corrective diff.

No public proof-of-concept exploit is currently listed for this CVE. The vulnerability mechanism is described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-11379

Indicators of Compromise

HTTP requests to Broadcast plugin maintenance endpoints containing do_check parameter values with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers on WordPress admin sessions pointing to external, untrusted domains immediately before administrative actions.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts, potentially exfiltrating session cookies or nonces.

Detection Strategies

Inspect web server access logs for query strings on Broadcast plugin URLs containing HTML tag characters or encoded script payloads in the do_check parameter.
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payload signatures on WordPress multi-site request paths.
Correlate suspicious inbound URLs with subsequent administrative activity such as user creation, plugin installation, or option changes.

Monitoring Recommendations

Enable WordPress audit logging for multi-site network administration events and review anomalies daily.
Monitor edge and reverse proxy telemetry for URL patterns targeting threewp-broadcast paths with suspicious parameter content.
Alert on browser-side Content Security Policy (CSP) violation reports originating from WordPress admin pages.

How to Mitigate CVE-2024-11379

Immediate Actions Required

Update the Broadcast (threewp-broadcast) plugin to a version newer than 51.01 that incorporates the fix from changeset 3200309.
Audit WordPress multi-site network administrator accounts for unexpected sessions, added users, or modified plugins.
Rotate session cookies and administrator passwords if suspicious do_check requests appear in access logs.

Patch Information

The vendor fix was committed in the WordPress Changeset Update, which introduces proper sanitization and output escaping for the do_check parameter in src/maintenance/controller.php. Administrators should upgrade through the WordPress plugin update mechanism and verify the installed version reflects the patched build.

Workarounds

Deactivate the Broadcast plugin on multi-site installations until the patched version is installed.
Apply WAF rules that block requests to the plugin's maintenance controller containing HTML or JavaScript characters in the do_check parameter.
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution.
Restrict access to network admin URLs by source IP where operationally feasible.

bash

# Example ModSecurity rule blocking scripted payloads in do_check
SecRule ARGS:do_check "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1011379,phase:2,deny,status:403,\
     msg:'CVE-2024-11379 Broadcast plugin do_check XSS attempt'"