CVE-2024-11435: WordPress Salavat Counter Plugin XSS Flaw

CVE-2024-11435 Overview

CVE-2024-11435 is a Reflected Cross-Site Scripting (XSS) vulnerability in the salavat counter Plugin for WordPress. The flaw affects all versions up to and including 0.9.4 and is tracked under [CWE-79]. The vulnerability stems from insufficient input sanitization and output escaping of the page parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link.

Critical Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a WordPress administrator, enabling session theft, account takeover, or further site compromise.

Affected Products

• WordPress plugin: salavat counter Plugin
• All versions up to and including 0.9.4
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2024-11-21 - CVE-2024-11435 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11435

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw located in the plugin's admin table handling logic, referenced at wp-table-class.php line 85. The page request parameter is reflected in the page output without proper sanitization or output escaping. An attacker crafts a URL containing malicious JavaScript in the page parameter. When an authenticated user, typically an administrator, clicks the link, the payload executes in their browser session.

Because the attack requires user interaction and executes with the victim's privileges, an attacker who targets a site administrator can perform any action the administrator can perform. This includes creating new admin accounts, modifying content, or installing malicious plugins. The scope-changed nature of the flaw allows script execution to affect resources beyond the vulnerable component's security context.

Root Cause

The root cause is missing input validation on the page GET parameter and absent output escaping when the value is rendered back into HTML. WordPress provides functions such as esc_attr(), esc_html(), and sanitize_text_field() that were not applied to the reflected value before output.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to an authenticated WordPress user with access to the plugin's admin pages. Delivery vectors include phishing emails, malicious forum posts, or attacker-controlled websites. No authentication is required by the attacker themselves, but victim interaction is mandatory. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review for the vulnerable code path.

// No verified exploitation code available.
// The vulnerability is triggered by a crafted URL where the
// `page` parameter contains an unsanitized script payload
// that is reflected into the rendered admin page HTML.

Detection Methods for CVE-2024-11435

Indicators of Compromise

• HTTP requests to WordPress admin URLs containing script tags, event handlers, or encoded JavaScript in the page query parameter.
• Unexpected creation of new administrator accounts or plugin installations following an administrator's browsing session.
• Web server access logs showing referrers from untrusted external domains linking directly to plugin admin pages.

Detection Strategies

• Inspect WordPress access logs for anomalous values in the page parameter targeting the salavat counter plugin routes.
• Deploy a Web Application Firewall (WAF) with rules that identify reflected XSS payloads such as <script>, onerror=, and javascript: schemes in query strings.
• Monitor administrator session activity for actions initiated shortly after the admin visited an external referrer.

Monitoring Recommendations

• Alert on WordPress user role changes, new admin account creation, and plugin or theme installations outside change windows.
• Log and review all requests to /wp-admin/ endpoints that contain HTML metacharacters in query parameters.
• Correlate browser telemetry with WordPress audit logs to identify script execution originating from crafted links.

How to Mitigate CVE-2024-11435

Immediate Actions Required

• Identify all WordPress instances running the salavat counter Plugin and inventory installed versions.
• Deactivate and remove the plugin on any site running version 0.9.4 or earlier until a patched version is confirmed installed.
• Rotate WordPress administrator passwords and invalidate active sessions if suspicious activity is detected.

Patch Information

A remediation was committed upstream. Review the WordPress Changeset Update for the specific code fix applied to the plugin. Update to the latest available version of the plugin from the WordPress plugin repository.

Workarounds

• Uninstall the salavat counter Plugin if a patched release is not deployed.
• Deploy WAF rules that block requests containing script payloads in the page query parameter.
• Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to reduce the impact of reflected script injection.

# Example WAF rule concept (ModSecurity-style) to block
# script payloads in the `page` parameter
SecRule ARGS:page "@rx (?i)(<script|onerror=|javascript:)" \
  "id:1004711,phase:2,deny,status:403,log,\
  msg:'Blocked reflected XSS attempt in page parameter (CVE-2024-11435)'"