CVE-2024-13509 Overview
CVE-2024-13509 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WS Form LITE and PRO plugins for WordPress. The flaw exists in all versions up to and including 1.10.13 and stems from insufficient input sanitization and output escaping on the url parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages. The issue is categorized as Improper Neutralization of Input During Web Page Generation [CWE-79]. The vulnerability is partially fixed in version 1.10.13 and completely remediated in version 1.10.14.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of any visitor to an affected page, enabling session theft, credential harvesting, and redirection attacks.
Affected Products
- WS Form LITE for WordPress — versions up to and including 1.10.13
- WS Form PRO for WordPress — versions up to and including 1.10.13
- Vendor: Westguardsolutions
Discovery Timeline
- 2025-01-28 - CVE-2024-13509 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13509
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw in the WS Form form-builder plugin for WordPress. The plugin accepts a url parameter but fails to properly sanitize input on write and fails to escape output on render. As a result, attacker-supplied HTML and JavaScript are stored in the WordPress database and reflected back to visitors of affected pages. Because exploitation does not require authentication, any unauthenticated user reachable over the network can plant a persistent payload.
Root Cause
The root cause is missing input sanitization and inadequate output escaping around the url parameter handling logic. WordPress provides helper functions such as esc_url(), esc_attr(), and wp_kses() for these tasks, but the vulnerable code paths in versions up to 1.10.13 did not apply them consistently. The vendor addressed the issue across two changesets: WordPress plugin repository changeset 3225862 (partial fix in 1.10.13) and changeset 3226595 (complete fix in 1.10.14).
Attack Vector
An attacker delivers a crafted request that stores malicious script content through the url parameter. When a subsequent visitor loads a page that renders the stored value, the payload executes under the origin of the WordPress site. Because the scope is changed (S:C), the injected script can affect resources beyond the vulnerable component, including the visitor's authenticated session with the site. User interaction is required in the form of visiting the injected page.
No public proof-of-concept is currently listed. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2024-13509
Indicators of Compromise
- Stored WS Form entries containing <script> tags, javascript: URIs, or HTML event handlers such as onerror= or onload= inside the url field.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that render WS Form content.
- WordPress database rows in WS Form tables where the url value fails a URL validation check.
Detection Strategies
- Audit stored WS Form submissions and configuration for values in the url parameter that do not parse as legitimate URLs.
- Enable Content Security Policy (CSP) reporting to surface unauthorized inline scripts loaded from WordPress pages hosting WS Form.
- Review web server access logs for POST requests to WS Form endpoints containing script-like payloads in the url parameter.
Monitoring Recommendations
- Monitor WordPress plugin inventories and alert when westguardsolutions/ws_form is installed at a version at or below 1.10.13.
- Track HTTP requests to wp-admin/admin-ajax.php and WS Form REST routes for anomalous payload sizes or encoded script fragments.
- Alert on new administrator accounts, plugin installs, or theme edits following visits to pages that render WS Form output.
How to Mitigate CVE-2024-13509
Immediate Actions Required
- Upgrade WS Form LITE or PRO to version 1.10.14 or later, which contains the complete fix.
- Inventory all WordPress installations to identify vulnerable WS Form deployments, including staging and archived sites.
- Review stored form data and page content for injected script payloads and remove any malicious entries.
- Rotate credentials and invalidate active administrator sessions if injection is confirmed.
Patch Information
The vendor released a partial fix in version 1.10.13 and a complete fix in version 1.10.14. Patch details are available in the vendor changesets: WordPress Changeset #3225862 and WordPress Changeset #3226595. See the WS Form Changelog for release notes.
Workarounds
- If immediate patching is not possible, deactivate the WS Form plugin until upgrade to 1.10.14 can be completed.
- Deploy a web application firewall (WAF) rule to block requests containing script tags or JavaScript URIs in the url parameter of WS Form endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts on pages that render WS Form output.
# Verify installed WS Form version via WP-CLI and upgrade to the fixed release
wp plugin get ws-form --field=version
wp plugin update ws-form --version=1.10.14
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.