CVE-2024-13779: Hero Mega Menu Plugin XSS Vulnerability

CVE-2024-13779 Overview

CVE-2024-13779 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Hero Mega Menu - Responsive WordPress Menu Plugin for WordPress. The flaw affects all versions up to and including 1.16.5 and stems from insufficient input sanitization and output escaping on the index parameter [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The vulnerability requires user interaction but no authentication, lowering the bar for exploitation against WordPress sites running the plugin.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, or redirection to malicious infrastructure.

Affected Products

• Hero Mega Menu - Responsive WordPress Menu Plugin versions up to and including 1.16.5
• WordPress sites with the plugin installed and active
• All site visitors and authenticated users including administrators are potential victims

Discovery Timeline

• 2025-03-05 - CVE-2024-13779 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-13779

Vulnerability Analysis

The vulnerability is a reflected XSS issue triggered through the index parameter handled by the Hero Mega Menu plugin. The plugin accepts attacker-controlled input from the request and reflects it into the rendered HTML response without proper sanitization or output escaping. When a victim follows a crafted URL containing a malicious payload in the index parameter, the browser parses the injected markup as part of the trusted page and executes the attacker's script in the site's origin.

Because the attack vector is Network-based and requires no privileges, any unauthenticated actor on the internet can construct an exploit URL. The scope is changed, indicating the injected script can affect resources beyond the vulnerable component, including other browser-accessible content on the WordPress site. The EPSS probability for this CVE is 0.411% at the 61st percentile.

Root Cause

The root cause is missing input validation and missing output encoding on the index query parameter. The plugin treats user-controlled input as safe and emits it directly into HTML context. Standard WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses() are not applied before reflection, allowing breakouts from attribute or text context into executable script context.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to a target user through phishing, social engineering, malicious advertising, or a compromised referrer. When the victim clicks the link, the index parameter payload is reflected into the response and executed in the victim's browser session with the site's privileges. If an authenticated administrator is targeted, the attacker can leverage script execution to perform administrative actions, exfiltrate session cookies, or pivot to persistent backdoors. Technical detail is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13779

Indicators of Compromise

• Web server access logs containing requests with HTML or JavaScript fragments in the index query parameter, such as <script>, onerror=, or URL-encoded equivalents like %3Cscript%3E
• Referrer headers from suspicious or unknown domains pointing to URLs containing the index parameter
• Unexpected administrator session activity or content changes following user clicks on external links

Detection Strategies

• Inspect HTTP request logs for anomalous values in the index parameter targeting endpoints associated with the Hero Mega Menu plugin
• Deploy a web application firewall (WAF) rule that blocks reflected XSS payload signatures in query strings
• Correlate browser security events such as Content Security Policy (CSP) violation reports with inbound requests containing scripted payloads

Monitoring Recommendations

• Forward WordPress access and error logs to a centralized log platform and alert on script-like content in query parameters
• Monitor for newly created administrator accounts, modified plugin files, and unexpected outbound connections from the web server
• Track plugin version inventory across all WordPress instances to confirm none remain on 1.16.5 or earlier

How to Mitigate CVE-2024-13779

Immediate Actions Required

• Identify all WordPress sites running the Hero Mega Menu plugin and confirm the installed version
• Update the plugin to a version newer than 1.16.5 once the vendor publishes a fix, or deactivate and remove the plugin if no patched release is available
• Apply WAF signatures to block reflected XSS payloads targeting the index parameter

Patch Information

No vendor patch is referenced in the NVD entry. Administrators should consult the Codecanyon Plugin Overview and the Wordfence Vulnerability Report for current remediation guidance and any subsequent patched releases.

Workarounds

• Disable the Hero Mega Menu plugin until a patched version is verified and installed
• Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script sources to limit XSS impact
• Require administrators to use separate browser sessions or profiles for WordPress administration to reduce the value of stolen session tokens

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate hero-menu
wp plugin delete hero-menu