CVE-2024-12156: WordPress AI Content Writer XSS Vulnerability

CVE-2024-12156 Overview

CVE-2024-12156 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress. The flaw exists in all versions up to and including 6.1.3. The plugin fails to sanitize input and escape output on the page parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when a victim clicks a crafted link. Successful exploitation requires user interaction, but the impact spans a changed security scope.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who clicks a crafted link, enabling session theft, account takeover, and administrative action hijacking.

Affected Products

AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress — versions up to and including 6.1.3
WordPress sites running the seo-help plugin
Administrator sessions interacting with the vulnerable plugin pages

Discovery Timeline

2024-12-12 - CVE-2024-12156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12156

Vulnerability Analysis

The vulnerability resides in the plugin's administrative scan results rendering logic, specifically in inc/scan-list-scan-table-header-results.php. The page request parameter is reflected into HTML output without sanitization or contextual escaping. An attacker crafts a URL containing malicious JavaScript in the page query string and lures an authenticated user to click it. The browser then renders the injected payload in the trusted origin of the WordPress admin interface.

Because the injection occurs in an admin-context page, executed script runs with the privileges of the victim's session. This allows the attacker to perform any action the victim can perform, including creating administrative users, modifying content, or exfiltrating cookies and nonces.

Root Cause

The root cause is missing input sanitization and missing output escaping on the page parameter. WordPress provides standard helpers such as sanitize_text_field() for input handling and esc_attr() or esc_html() for output. The affected code path uses none of these, allowing raw attacker-controlled data to reach the response body.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker delivers a crafted link through phishing, forum posts, or malicious advertisements. When a logged-in WordPress user clicks the link, the reflected payload executes in their browser. The scope change reflects that injected script can access data or functionality beyond the plugin's own security boundary, including the broader WordPress admin session.

Example request pattern (conceptual):
GET /wp-admin/admin.php?page=<injected_payload>

The vulnerable rendering code echoes the value of the `page`
parameter into an HTML context without calling esc_attr() or
esc_html(). See the plugin source reference for the exact
unescaped output location at line 102 of
scan-list-scan-table-header-results.php.

Detection Methods for CVE-2024-12156

Indicators of Compromise

Web server access logs containing page= values with HTML tag characters, javascript: URIs, or encoded script payloads targeting /wp-admin/ endpoints associated with the seo-help plugin.
Unexpected creation of WordPress administrator accounts or modifications to user roles following an admin session.
Referer headers pointing to external, untrusted domains preceding requests to plugin admin pages.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query string parameters for XSS patterns, including <script>, onerror=, and encoded variants targeting the page parameter.
Enable WordPress audit logging to capture administrative actions with source IP and user agent context for post-incident correlation.
Correlate outbound HTTP requests from browsers to unknown domains immediately following admin panel access.

Monitoring Recommendations

Monitor for HTTP 200 responses to /wp-admin/admin.php?page= requests containing suspicious characters in the page parameter.
Alert on new administrator user creation events and privilege changes in WordPress within short time windows of admin logins.
Review browser Content Security Policy (CSP) violation reports for inline script executions on admin pages.

How to Mitigate CVE-2024-12156

Immediate Actions Required

Update the AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin to a version above 6.1.3 once released by the vendor.
If no patched version is available, deactivate and remove the plugin from WordPress installations until a fix is confirmed.
Force logout of all administrative sessions and rotate credentials for accounts that may have clicked untrusted links.

Patch Information

Refer to the WordPress Plugin Changeset Log for the vendor's code changes and the Wordfence Vulnerability Report for remediation guidance. The vulnerable code location is documented in the WordPress Plugin Code Reference.

Workarounds

Deploy a WAF rule to block or sanitize requests where the page parameter contains HTML metacharacters when targeting the plugin's admin pages.
Implement a strict Content Security Policy on WordPress admin pages that disallows inline scripts and restricts script sources to trusted origins.
Restrict WordPress admin access to specific IP ranges via web server configuration to reduce the attack surface for reflected payloads.

bash

# Example nginx location block restricting wp-admin access
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;

    # Add a restrictive CSP header for admin pages
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;

    try_files $uri $uri/ /index.php?$args;
}