CVE-2024-13705 Overview
CVE-2024-13705 is a Reflected Cross-Site Scripting (XSS) vulnerability in the StageShow plugin for WordPress. The flaw affects all plugin versions up to and including 9.8.6. It stems from the use of remove_query_arg without proper escaping on URLs within the plugin's seating management interface [CWE-79].
Unauthenticated attackers can inject arbitrary web scripts into pages. Successful exploitation requires tricking an authenticated user into clicking a crafted link. Once triggered, the injected script executes in the victim's browser session under the vulnerable site's origin.
Critical Impact
Attackers can hijack administrator sessions, exfiltrate cookies, or perform actions on behalf of the victim by delivering a crafted URL to a logged-in WordPress user.
Affected Products
- StageShow plugin for WordPress, all versions through 9.8.6
- WordPress sites running the stageshow_project/stageshow component
- Administrators and privileged users accessing the plugin's seating management pages
Discovery Timeline
- 2025-01-30 - CVE-2024-13705 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13705
Vulnerability Analysis
The vulnerability resides in the StageShow plugin's seating administration code at admin/stageshow_manage_seating.php. The plugin invokes WordPress's remove_query_arg() function to strip query string parameters, then reflects the resulting URL back into the page without escaping it. Because remove_query_arg() does not sanitize or encode input, attacker-supplied content in the request URL flows directly into rendered HTML.
This is a classic reflected XSS pattern specific to WordPress plugins. An attacker crafts a URL containing JavaScript payloads in the query string. When a victim loads the URL while authenticated, the browser executes the payload in the context of the WordPress site.
Root Cause
The root cause is missing output escaping on a URL constructed from user-controlled request data. WordPress recommends wrapping the output of remove_query_arg() with esc_url() before echoing it to HTML attributes. The vulnerable code path omitted this escaping, allowing script-containing fragments to be reflected verbatim into the response.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker builds a crafted URL pointing to the vulnerable seating management endpoint with a malicious payload embedded in the query string. The attacker then delivers the link via phishing email, forum post, or social engineering. When a logged-in administrator clicks the link, the payload executes in their session and can perform privileged actions, including creating new administrator accounts or injecting persistent backdoors.
See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the vulnerable code location and reproduction details.
Detection Methods for CVE-2024-13705
Indicators of Compromise
- Web server access logs containing requests to admin/stageshow_manage_seating.php with query strings including <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript.
- Referrer headers from external domains preceding requests to StageShow admin endpoints.
- Unexpected new WordPress administrator accounts or modified user roles following administrator clicks on external links.
Detection Strategies
- Inspect HTTP access logs for reflected payloads targeting StageShow admin URLs and correlate with authenticated administrator sessions.
- Deploy a Web Application Firewall rule to flag query strings containing script tags, event handlers, or JavaScript URI schemes directed at /wp-admin/ paths.
- Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution originating from the WordPress admin surface.
Monitoring Recommendations
- Alert on WordPress audit log events showing privilege escalation, user creation, or plugin installation shortly after an administrator opened an external link.
- Track outbound requests from browsers on administrator workstations to unknown domains while sessions to the WordPress admin console are active.
- Review the installed StageShow plugin version across all managed WordPress instances and alert on versions 9.8.6 or earlier.
How to Mitigate CVE-2024-13705
Immediate Actions Required
- Update the StageShow plugin to the version released after change set 3258990, which introduces proper URL escaping.
- Audit all WordPress administrator accounts for unauthorized additions or role changes.
- Invalidate active WordPress sessions and force password resets for privileged users if exploitation is suspected.
Patch Information
The vendor fixed the issue in WordPress Plugin change set 3258990, which added escaping helpers in include/stageshowlib_escaping.php and applied them within admin/stageshow_manage_seating.php. See WordPress Change Set #3258990 - manage_seating.php and WordPress Change Set #3258990 - escaping.php for the patch diff.
Workarounds
- Disable the StageShow plugin until the patched version is deployed.
- Deploy a WAF rule that blocks requests to StageShow admin paths containing script tags or JavaScript URI schemes in the query string.
- Enforce a strict Content Security Policy on the WordPress admin area to prevent execution of inline scripts.
- Instruct administrators to avoid clicking untrusted links while authenticated to WordPress and to use a separate browser profile for admin tasks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
