CVE-2024-12325: WordPress Waymark Plugin XSS Vulnerability

CVE-2024-12325 Overview

CVE-2024-12325 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Waymark plugin for WordPress. The flaw affects all plugin versions up to and including 1.4.1. It stems from insufficient input sanitization and output escaping on the content parameter within the plugin's admin settings code path.

Unauthenticated attackers can inject arbitrary web scripts that execute when a targeted user clicks a crafted link. Successful exploitation runs attacker-controlled JavaScript in the victim's browser session against the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser context on sites running Waymark ≤ 1.4.1, enabling session theft, admin action forgery, and phishing pivots.

Affected Products

Waymark plugin for WordPress, all versions ≤ 1.4.1
WordPress sites with the Waymark plugin installed and active
Administrative interface files inc/Admin/Waymark_Settings.php (lines 1457, 1458, 1531, 1532)

Discovery Timeline

2024-12-11 - CVE-2024-12325 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12325

Vulnerability Analysis

The vulnerability is a Reflected XSS issue in the Waymark plugin's settings code path. User-supplied input from the content parameter is rendered back into the page without adequate sanitization or output escaping. When a victim visits a crafted URL, injected script executes in the browser under the origin of the WordPress site.

Because the attack requires no authentication and exploitation occurs entirely through a victim's browser, the vulnerability is a strong candidate for phishing-driven campaigns targeting site administrators. Executed script can perform any action the victim is authorized to perform, including modifying settings if an administrator is tricked into visiting the payload URL.

Root Cause

The root cause is missing input sanitization and missing output escaping on the content parameter processed within inc/Admin/Waymark_Settings.php. Reflected values are echoed back into administrative pages without functions such as esc_html(), esc_attr(), or wp_kses() applied. This categorizes the issue as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an attacker to craft a URL containing a malicious payload in the content parameter and social-engineer a victim into clicking it. User interaction is required; no valid credentials are needed on the target site. The scope changes because the injected script executes in the victim's browser context, potentially reaching resources beyond the vulnerable component.

The vulnerability manifests when the plugin reflects the content parameter back into rendered HTML without escaping. See the Wordfence Vulnerability Analysis and the referenced WordPress Plugin Code Line 1457 for the affected sink locations.

Detection Methods for CVE-2024-12325

Indicators of Compromise

HTTP requests to Waymark administrative endpoints containing a content parameter with <script>, javascript:, or HTML event-handler substrings such as onerror= or onload=.
Referrer logs showing external domains directing users to Waymark settings URLs with encoded payloads.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting a Waymark admin URL.

Detection Strategies

Inspect web server access logs for URL-encoded XSS payloads targeting the content parameter on Waymark admin routes.
Deploy Web Application Firewall (WAF) rules that decode and normalize query strings before matching common XSS signatures.
Correlate anomalous admin session activity, such as unexpected plugin modifications, with prior visits to reflected URLs.

Monitoring Recommendations

Enable WordPress audit logging for administrative actions and plugin setting changes.
Monitor Content Security Policy (CSP) violation reports to surface script-injection attempts against WordPress origins.
Alert on inbound links to wp-admin pages that carry query parameters with HTML control characters.

How to Mitigate CVE-2024-12325

Immediate Actions Required

Update the Waymark plugin to a version newer than 1.4.1 that includes the fix from WordPress Plugin Changeset #3205103.
If an update is not immediately feasible, deactivate and remove the Waymark plugin until it can be patched.
Review recent administrator activity for evidence of unauthorized configuration changes.

Patch Information

The vendor addressed the issue in the plugin repository under changeset 3205103, which introduces proper sanitization and escaping around the affected sinks in inc/Admin/Waymark_Settings.php. Site operators should install the released fixed version from the WordPress plugin directory. Refer to the WordPress Plugin Changeset #3205103 for the exact code changes.

Workarounds

Restrict access to WordPress administrative URLs by source IP where operationally possible.
Deploy a WAF rule that blocks requests containing raw or encoded <script> tags and JavaScript event handlers in query parameters.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages.
Train administrators to avoid clicking untrusted links that reference the WordPress admin interface.

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads on the 'content' parameter
SecRule ARGS:content "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002325,phase:2,deny,status:403,\
     msg:'CVE-2024-12325 Waymark XSS attempt blocked',\
     tag:'CWE-79',tag:'wordpress',tag:'waymark'"