CVE-2024-11466 Overview
The Intro Tour Tutorial DeepPresentation plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the tab parameter. The flaw affects all versions up to and including 6.5.2. Unauthenticated attackers can inject arbitrary web scripts into pages by crafting a malicious URL. The payload executes in a victim's browser when they click the link. According to the NVD entry, CVE-2025-24566 may be a duplicate of this issue.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site.
Affected Products
- Intro Tour Tutorial DeepPresentation plugin for WordPress
- All versions through 6.5.2
- WordPress installations with the dp-intro-tours plugin enabled
Discovery Timeline
- 2024-12-04 - CVE-2024-11466 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11466
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting flaw within the plugin's administrative settings interface. The affected code path resides in admin/class-dp-intro-tours-admin-settings.php around line 125, where the tab request parameter is reflected into rendered HTML output. The plugin fails to sanitize user-supplied input and does not properly escape the value before writing it back to the response. Attackers craft URLs containing malicious JavaScript in the tab query string and lure privileged users into clicking them. The injected script then executes in the browser of the victim under the origin of the vulnerable WordPress site.
Root Cause
The root cause is insufficient input sanitization and missing output escaping when the plugin echoes the tab parameter into HTML content. WordPress provides functions such as esc_attr(), esc_html(), and sanitize_text_field() for exactly this purpose, but the vulnerable code path in the plugin does not apply them consistently to the reflected value.
Attack Vector
Exploitation requires user interaction. An unauthenticated attacker constructs a URL pointing to the vulnerable WordPress admin settings page with a script payload embedded in the tab parameter. The attacker delivers this URL through phishing, forum posts, or other social engineering channels. When an authenticated WordPress administrator visits the link, the payload executes in their browser session. The scope is changed because script executes in the administrative context, enabling actions such as creating new admin users, modifying plugin settings, or injecting persistent backdoors.
No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Settings Code for technical details.
Detection Methods for CVE-2024-11466
Indicators of Compromise
- Web server access logs containing requests to plugin admin pages with tab= values that include HTML tags, JavaScript keywords, or URL-encoded script fragments such as %3Cscript%3E.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains following clicks on links referencing the dp-intro-tours plugin.
- Creation of new WordPress administrator accounts or unexplained modifications to plugin or theme files shortly after an admin session.
Detection Strategies
- Inspect WordPress installations for the presence of the dp-intro-tours plugin at version 6.5.2 or earlier.
- Deploy a web application firewall (WAF) rule that flags requests containing script-like patterns in the tab query parameter targeting WordPress admin endpoints.
- Correlate referer headers on administrator sessions with newly created users, role changes, or plugin uploads to identify likely XSS-driven abuse.
Monitoring Recommendations
- Aggregate WordPress access and audit logs in a centralized platform and alert on suspicious tab parameter values.
- Monitor administrator user creation events and plugin file modifications in near real-time.
- Track outbound HTTP requests from browsers used for site administration to detect exfiltration attempts triggered by injected scripts.
How to Mitigate CVE-2024-11466
Immediate Actions Required
- Identify all WordPress sites running the Intro Tour Tutorial DeepPresentation plugin at version 6.5.2 or earlier.
- Deactivate and remove the plugin until a patched version is confirmed installed if administrative use is not required.
- Force password resets and review recent administrator activity for any WordPress account that may have clicked untrusted links.
Patch Information
Refer to the WordPress Plugin Changeset Update tracked in the plugin's repository and the Wordfence Vulnerability Report for the fixed version. Upgrade to the latest release of the dp-intro-tours plugin from the WordPress plugin directory as soon as possible.
Workarounds
- Deploy WAF signatures that block requests containing HTML or JavaScript payloads in the tab parameter on WordPress administrative URLs.
- Restrict access to the WordPress admin interface using IP allowlisting or VPN-only access to reduce phishing exposure.
- Enforce a strict Content Security Policy (CSP) on the WordPress admin origin to limit execution of inline and third-party scripts.
- Train administrators to avoid clicking untrusted links that reference the site's own admin URLs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
