CVE-2024-12611: School Management System WordPress XSS Flaw

CVE-2024-12611 Overview

CVE-2024-12611 is a Reflected Cross-Site Scripting (XSS) vulnerability in the School Management System for WordPress plugin by Dasinfomedia. The flaw affects all versions up to and including 93.0.0. The plugin fails to properly sanitize input and escape output on the title parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session token theft, redirection to malicious sites, or actions performed on behalf of the authenticated user.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session by tricking users into clicking a crafted URL containing a malicious title parameter.

Affected Products

Dasinfomedia School Management System for WordPress — all versions up to and including 93.0.0
WordPress installations with the plugin active
Any site sourced from the CodeCanyon distribution of the plugin

Discovery Timeline

2025-03-07 - CVE-2024-12611 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12611

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the School Management System for WordPress plugin. The plugin accepts the title request parameter and reflects its value into the rendered HTML response without applying sufficient input sanitization or output escaping. When a victim visits a URL containing attacker-controlled markup, the browser parses and executes the injected script in the origin of the vulnerable site.

Because the injection point is reflected, exploitation requires user interaction. An attacker typically delivers the payload through phishing emails, forum posts, or malicious advertisements that link to the vulnerable endpoint. When executed in the browser of an authenticated administrator, the payload can perform privileged actions such as creating new admin accounts or exfiltrating session cookies.

Root Cause

The underlying weakness aligns with insufficient neutralization of input during web page generation. The title parameter is passed directly from the HTTP request into the response body without functions such as esc_html(), esc_attr(), or wp_kses() being applied. The associated weakness in the NVD record is listed as [CWE-862]. The functional defect corresponds to CWE-79, Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is remote, requires no authentication, and requires user interaction. An attacker crafts a URL that includes a JavaScript payload in the title parameter and delivers it to the target. When the victim loads the URL, the plugin reflects the payload into the response and the browser executes it in the context of the vulnerable WordPress site. The vulnerability does not require any privileges on the target site to weaponize.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-12611

Indicators of Compromise

Web server access logs containing requests to plugin endpoints with a title parameter containing HTML tags such as <script>, <img>, <svg>, or onerror= attributes
URL-encoded payloads in the title query string such as %3Cscript%3E or %3Cimg%20src
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
Creation of new WordPress administrator accounts without a corresponding audit trail

Detection Strategies

Deploy a web application firewall rule that inspects the title parameter for HTML metacharacters and common XSS payload signatures
Correlate HTTP request patterns targeting School Management System plugin endpoints with subsequent administrative actions
Review referer headers on privileged WordPress admin actions to identify requests originating from unexpected external sites

Monitoring Recommendations

Enable WordPress audit logging to record administrative changes, plugin activity, and user creation events
Monitor browser telemetry from privileged workstations for anomalous script execution or credential submission
Alert on modifications to plugin files, theme files, or wp_options performed outside of scheduled maintenance windows

How to Mitigate CVE-2024-12611

Immediate Actions Required

Identify all WordPress sites running the Dasinfomedia School Management System plugin and confirm the installed version
Update the plugin to a version later than 93.0.0 once the vendor publishes a fix
Restrict administrative access to trusted networks and enforce multi-factor authentication on all privileged accounts
Instruct administrators to avoid clicking untrusted links pointing to the WordPress site while authenticated

Patch Information

At the time of the latest NVD update on 2026-06-17, no vendor patch reference is listed in the CVE record. Refer to the vendor page at CodeCanyon WordPress School System and the Wordfence Vulnerability Report for update availability.

Workarounds

Deactivate the School Management System plugin until a patched version is available
Deploy a web application firewall rule to block requests where the title parameter contains HTML tags, event handlers, or javascript: schemes
Add a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Use a reverse proxy or WordPress security plugin to normalize and reject malformed query parameters

bash

# Example WAF rule to block XSS payloads in the title parameter (ModSecurity)
SecRule ARGS:title "@rx (?i)(<script|onerror=|onload=|javascript:|<svg|<img[^>]+src)" \
    "id:1012611,phase:2,deny,status:403,log,msg:'CVE-2024-12611 XSS attempt in title parameter'"