CVE-2024-11807: NPS Computy WordPress Plugin XSS Vulnerability

CVE-2024-11807 Overview

CVE-2024-11807 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the NPS computy plugin for WordPress. All versions up to and including 2.8.0 fail to properly sanitize input and escape output for the data1 and data2 parameters. Unauthenticated attackers can craft URLs containing malicious JavaScript payloads that execute in a victim's browser when the user is tricked into clicking the link.

The issue was analyzed and published through Wordfence threat intelligence and corresponds to a patch committed to the plugin's trunk on the WordPress.org repository.

Critical Impact
Successful exploitation allows script execution in the context of the victim's session, enabling session token theft, forced administrative actions, or redirection to attacker-controlled pages.

Affected Products

NPS computy plugin for WordPress, all versions up to and including 2.8.0
WordPress sites with the vulnerable plugin installed and active
Any user session interacting with a crafted URL targeting the affected site

Discovery Timeline

2024-12-04 - CVE-2024-11807 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11807

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the NPS computy WordPress plugin. The plugin accepts values from the data1 and data2 HTTP request parameters and reflects them into the rendered HTML response without sufficient sanitization or output escaping. Because the reflection occurs in an unauthenticated code path, no login or existing session on the target site is required to trigger the flaw.

Exploitation requires user interaction. An attacker delivers a crafted URL via phishing, malvertising, forum posts, or messaging platforms. When a victim visits the URL, the injected script executes in the origin of the vulnerable WordPress site, giving the attacker access to that origin's cookies, DOM, and any authenticated actions the victim can perform.

The scope of impact is elevated because the injected script runs in the security context of the WordPress site rather than the attacker's domain, which explains the changed scope in the vulnerability metrics.

Root Cause

The root cause is missing input sanitization on the data1 and data2 request parameters combined with missing output escaping when those values are rendered back into HTML. WordPress provides functions such as sanitize_text_field() for input and esc_html(), esc_attr(), or esc_url() for context-aware output escaping. The vulnerable versions of NPS computy did not apply these controls to the parameters, allowing raw HTML and JavaScript to pass through into the response body.

Attack Vector

Attack delivery is network-based and requires the victim to click a specially crafted link. See the Wordfence Vulnerability Analysis for the specific parameters and endpoints, and the WordPress Plugin Changeset for the code changes applied in the fix. A typical payload would place a <script> tag or JavaScript event handler into the data1 or data2 query string, which is then reflected verbatim into the HTML response.

Detection Methods for CVE-2024-11807

Indicators of Compromise

HTTP requests to pages served by the NPS computy plugin containing data1 or data2 parameters with HTML tags, <script> fragments, javascript: URIs, or event handler attributes such as onerror= or onload=.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E, %3Cimg, or %20on sequences in the data1 or data2 query values.
Referrer headers indicating traffic originating from external phishing or short-link domains landing on plugin endpoints with suspicious parameters.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the data1 and data2 parameters for HTML metacharacters and known XSS signatures.
Monitor WordPress access logs for anomalous query string lengths or encoded script fragments targeting plugin routes.
Correlate outbound browser telemetry with unexpected script execution on pages served by the affected site.

Monitoring Recommendations

Enable verbose HTTP logging on the WordPress front end and forward logs to a centralized analytics platform for signature and anomaly review.
Alert on repeated requests from a single source that include HTML-encoded characters within data1 or data2 values.
Track user reports of unexpected redirects, popups, or credential prompts originating from pages hosted by the plugin.

How to Mitigate CVE-2024-11807

Immediate Actions Required

Update the NPS computy plugin to a version later than 2.8.0 that contains the sanitization fix committed in changeset 3198661.
If an update is not immediately possible, deactivate and remove the plugin until a patched version is applied.
Review web server logs for prior exploitation attempts against the data1 and data2 parameters and investigate any administrative account activity that followed suspicious hits.

Patch Information

The vendor addressed the issue in a plugin release corresponding to the WordPress Plugin Changeset 3198661, which introduces sanitization and escaping for the affected parameters. Administrators should install the latest plugin version available in the WordPress plugin directory.

Workarounds

Deploy WAF rules that block requests containing HTML or JavaScript metacharacters in the data1 and data2 parameters.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins to limit XSS impact.
Educate administrators and privileged users to avoid clicking untrusted links that reference the WordPress site's domain with unusual query strings.

bash

# Example ModSecurity rule to block HTML/script payloads in data1 and data2
SecRule ARGS:data1|ARGS:data2 "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "id:1009110,phase:2,deny,status:403,log,msg:'Possible XSS in NPS computy data1/data2 (CVE-2024-11807)'"