CVE-2024-12441: BP Email Assign Templates XSS Vulnerability

CVE-2024-12441 Overview

The BP Email Assign Templates plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the page parameter. The flaw affects all versions up to and including 1.5. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking a user into clicking a crafted link. The injected script then executes in the victim's browser session within the WordPress site context. CVE-2025-24631 is likely a duplicate of this issue. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser, enabling session hijacking, credential theft, or forced administrative actions on the WordPress site.

Affected Products

BP Email Assign Templates plugin for WordPress
All versions up to and including 1.5
WordPress sites using BuddyPress with this plugin installed

Discovery Timeline

2024-12-12 - CVE CVE-2024-12441 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12441

Vulnerability Analysis

The vulnerability resides in the plugin's admin handling logic in pp-email-templates-admin.php. The page request parameter is reflected into the HTML response without proper sanitization or output escaping. This produces a classic Reflected XSS condition, where the attack payload is delivered via URL and executed in the victim's browser. Because the injection occurs in an administrative context, a successful attack can lead to full site compromise if an administrator is targeted. The scope change indicated in the vulnerability metrics reflects the ability to affect resources beyond the vulnerable component, including the authenticated user's session.

Root Cause

The plugin fails to apply WordPress sanitization functions such as sanitize_text_field() on incoming request data. It also omits output escaping functions like esc_attr() or esc_html() when rendering the page parameter back into the page. The vulnerable code path is documented in the WordPress Plugin Code Review.

Attack Vector

An unauthenticated attacker crafts a URL containing a malicious payload in the page query parameter. The attacker delivers the link via phishing, forum posts, or third-party sites. When a logged-in WordPress administrator clicks the link, the browser renders the reflected payload and executes attacker-controlled JavaScript. The script can exfiltrate cookies, perform CSRF-style administrative actions, or inject persistent backdoors through the plugin editor. No authentication is required to construct the payload, but user interaction is required for execution. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2024-12441

Indicators of Compromise

HTTP requests to WordPress admin pages containing script tags, javascript: URIs, or encoded payloads in the page query parameter.
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after clicking external links.
New or modified WordPress administrator accounts, plugins, or theme files with no corresponding change ticket.

Detection Strategies

Inspect web server access logs for requests to plugin admin endpoints with suspicious page parameter values such as <script>, onerror=, or URL-encoded equivalents.
Deploy a web application firewall rule that flags reflected XSS payload patterns targeting WordPress admin routes.
Correlate administrator session activity with recent inbound URL clicks to detect anomalous post-click behavior.

Monitoring Recommendations

Monitor changes to WordPress user roles, plugin files, and theme editor content for unauthorized modifications.
Enable logging of authenticated admin actions and review them for actions initiated outside normal workflow patterns.
Track plugin version inventory across managed WordPress sites to identify hosts still running BP Email Assign Templates 1.5 or earlier.

How to Mitigate CVE-2024-12441

Immediate Actions Required

Update the BP Email Assign Templates plugin to a version newer than 1.5 where the sanitization fix has been applied.
If no patched release is available for your environment, deactivate and remove the plugin until a fix is verified.
Force password resets and session invalidation for WordPress administrator accounts that may have clicked untrusted links.

Patch Information

The upstream fix is recorded in WordPress Changeset #3206532. Administrators should verify their installed plugin version reflects code from this changeset or later. Confirm the fix by reviewing that the page parameter is now processed with WordPress sanitization and output escaping helpers.

Workarounds

Restrict access to the WordPress admin area by IP allowlisting at the web server or WAF layer.
Configure a Content Security Policy (CSP) header that disallows inline script execution in the admin interface.
Train administrators to avoid clicking unsolicited links that reference WordPress admin URLs with unusual query strings.

bash

# Example nginx rule to block obvious XSS payloads in the page parameter
if ($arg_page ~* "(<|%3C)script|javascript:|onerror=") {
    return 403;
}