CVE-2024-11446: Chessgame Shizzle Plugin XSS Vulnerability

CVE-2024-11446 Overview

CVE-2024-11446 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Chessgame Shizzle plugin for WordPress. The flaw affects all plugin versions up to and including 1.3.0. The vulnerability resides in the handling of the cs_nonce parameter, which lacks proper input sanitization and output escaping [CWE-79].

Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser after the victim clicks a crafted link. Successful exploitation can lead to session token theft, forced browser actions, and content manipulation within the WordPress site context.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who clicks a malicious link targeting a vulnerable Chessgame Shizzle installation.

Affected Products

Chessgame Shizzle plugin for WordPress, all versions through 1.3.0
Vulnerable file: thirdparty/pgn4web/cs-preview-iframe.php
Vulnerable parameter: cs_nonce

Discovery Timeline

2024-11-23 - CVE-2024-11446 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11446

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the Chessgame Shizzle WordPress plugin. The plugin reads the cs_nonce request parameter inside cs-preview-iframe.php and reflects its value back into the HTML response without applying sanitization or contextual output escaping.

Because the reflected value is rendered directly in the page, an attacker can craft a URL containing JavaScript payloads in the cs_nonce parameter. When a victim clicks the link, the payload executes under the origin of the WordPress site.

The attack requires user interaction and does not require authentication. Impact scope is changed because scripts execute in the victim's browser session, potentially reaching authenticated administrator context if an administrator is targeted.

Root Cause

The root cause is insufficient input validation and missing output escaping when handling the cs_nonce GET parameter. The plugin treats attacker-controlled request data as trusted content and emits it into the HTML response of the preview iframe generated by cs-preview-iframe.php. Proper use of WordPress escaping functions such as esc_attr() or esc_html() would neutralize the injected markup.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker constructs a URL to the vulnerable plugin endpoint with a malicious payload in the cs_nonce query parameter. The attacker delivers the URL through phishing, malicious advertising, forum posts, or embedded links.

When the victim visits the URL, the server reflects the payload into the response HTML and the browser executes the injected script. The attacker can steal cookies, hijack authenticated sessions, perform administrative actions on behalf of privileged users, or redirect users to attacker-controlled sites. See the WordPress Plugin File Snapshot for the vulnerable code location.

Detection Methods for CVE-2024-11446

Indicators of Compromise

Web server access logs containing requests to cs-preview-iframe.php with unusual characters in the cs_nonce parameter such as <, >, ", ', or URL-encoded equivalents like %3Cscript.
Referrer headers pointing to unknown external domains preceding requests to the plugin endpoint.
Outbound requests from user browsers to attacker-controlled domains shortly after visiting a WordPress page hosting the plugin.

Detection Strategies

Deploy web application firewall (WAF) rules that identify script tags, event handlers such as onerror= or onload=, and JavaScript URIs in the cs_nonce parameter.
Correlate spikes in requests to cs-preview-iframe.php with anomalous query string entropy or length as an indicator of injection attempts.
Monitor for user reports of unexpected redirects, credential prompts, or browser warnings originating from the WordPress site.

Monitoring Recommendations

Enable verbose HTTP access logging for the /wp-content/plugins/chessgame-shizzle/ path and retain logs for forensic review.
Alert on any HTTP 200 response returning reflected content containing script markup in query parameters.
Track authenticated administrator session activity for suspicious follow-on actions such as new user creation or plugin installation after XSS attempts.

How to Mitigate CVE-2024-11446

Immediate Actions Required

Update the Chessgame Shizzle plugin to a version newer than 1.3.0 that includes the fix committed in WordPress Plugin Changeset 3194845.
If no patched version is available, deactivate and remove the plugin from all WordPress installations.
Rotate WordPress administrator credentials and session tokens if evidence of exploitation is present.

Patch Information

The vendor addressed the vulnerability in a WordPress plugin repository changeset that modifies cs-preview-iframe.php to sanitize and escape the cs_nonce parameter before reflecting it in the HTML response. Refer to the Wordfence Vulnerability Report for detailed remediation guidance and the fixed version identifier.

Workarounds

Block requests to cs-preview-iframe.php at the WAF or reverse proxy layer until the plugin is updated.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Educate administrators and editors to avoid clicking untrusted links pointing to the WordPress site while authenticated.

bash

# Example ModSecurity rule to block script payloads in cs_nonce parameter
SecRule ARGS:cs_nonce "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1004411446,phase:2,deny,status:403,\
    msg:'CVE-2024-11446 Chessgame Shizzle XSS attempt blocked'"