CVE-2024-12177: AI Image Alt Text Generator XSS Vulnerability

CVE-2024-12177 Overview

CVE-2024-12177 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Ai Image Alt Text Generator for WP plugin by wpmessiah. The flaw affects all versions up to and including 1.0.6. It stems from insufficient input sanitization and output escaping on the page parameter within the plugin's admin menu handling code. Unauthenticated attackers can craft malicious URLs that inject arbitrary web scripts, which execute in a victim's browser when the victim clicks the link. Successful exploitation can lead to session hijacking, admin account takeover, or content manipulation on affected WordPress sites.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling privileged actions against affected WordPress installations.

Affected Products

wpmessiah Ai Image Alt Text Generator for WP versions 1.0.0 through 1.0.6
WordPress installations with the plugin active in the admin dashboard
Sites running the vulnerable code in class-boomdevs-ai-image-alt-text-generator-custom-menu.php

Discovery Timeline

2025-01-30 - CVE-2024-12177 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12177

Vulnerability Analysis

The plugin reads the page query parameter from the admin request and reflects the value into HTML output without proper sanitization or escaping. Because the reflection occurs server-side and echoes attacker-controlled input into the rendered page, an attacker can inject <script> payloads or event handlers that execute in the victim's browser. The vulnerable code path resides in the plugin's custom menu class, referenced in the WordPress plugin trac at line 218 of class-boomdevs-ai-image-alt-text-generator-custom-menu.php. Exploitation requires user interaction: an administrator or logged-in user must click a crafted link. When executed in an administrator context, the injected script inherits full admin privileges within the browser session.

Root Cause

The root cause is missing input sanitization and output escaping when handling the page GET parameter. WordPress provides standard functions such as esc_attr(), esc_html(), and sanitize_text_field() for this purpose, but the vulnerable code path fails to apply them before echoing the parameter value into HTML.

Attack Vector

An attacker crafts a URL targeting the WordPress admin page controlled by the plugin, embedding a JavaScript payload in the page parameter. The attacker delivers the link through phishing email, chat, or a malicious website. When an authenticated WordPress user, ideally an administrator, follows the link, the plugin renders the malicious payload in the admin interface and the browser executes it. See the Wordfence Vulnerability Report and the WordPress Plugin Code File for the specific reflection location.

// No verified proof-of-concept code available.
// The vulnerability is triggered by supplying a crafted value in the
// `page` URL parameter to the plugin's admin menu handler, where the
// value is reflected into HTML without escaping.

Detection Methods for CVE-2024-12177

Indicators of Compromise

Web server access logs containing requests to /wp-admin/ with suspicious page= values that include <script>, onerror=, onload=, or URL-encoded equivalents (%3Cscript%3E).
Outbound requests from administrator browser sessions to unfamiliar domains shortly after clicking an emailed or chat-delivered link.
Unexpected new administrator accounts, changed user emails, or modified plugin/theme files following an admin login.

Detection Strategies

Inspect WordPress access logs for requests containing HTML tag characters or JavaScript event handlers in the page parameter.
Deploy a web application firewall (WAF) with rules covering reflected XSS patterns targeting wp-admin query strings.
Correlate administrator authentication events with subsequent configuration changes, plugin installs, or user creations to identify session abuse.

Monitoring Recommendations

Alert on any page parameter values that contain <, >, ", ', or common XSS keywords such as script, alert, onerror.
Monitor plugin file integrity for the Ai Image Alt Text Generator for WP directory to detect tampering.
Track newly created WordPress users and role changes on sites where the plugin is installed.

How to Mitigate CVE-2024-12177

Immediate Actions Required

Update the Ai Image Alt Text Generator for WP plugin to a version above 1.0.6 that includes the fix committed in WordPress Changeset #3230467.
If no patched version is available in your environment, deactivate and remove the plugin until a fixed release is confirmed.
Review WordPress administrator accounts and rotate credentials for any admin who may have clicked untrusted links since the plugin was installed.

Patch Information

The vendor addressed the sanitization gap in WordPress Changeset #3230467. Site administrators should upgrade to the latest available release from the WordPress plugin repository. Verify the installed version under Plugins > Installed Plugins in the WordPress dashboard after updating.

Workarounds

Restrict access to the WordPress admin interface via IP allow-listing at the web server or WAF layer.
Enforce a Content Security Policy (CSP) that disallows inline scripts on /wp-admin/ responses to blunt reflected XSS payloads.
Require administrators to authenticate through a separate browser profile and avoid clicking external links while logged into WordPress.

bash

# Example nginx rule to block obvious XSS payloads in the `page` parameter
if ($args ~* "page=[^&]*(<|%3C)(script|/script|img|svg)") {
    return 403;
}