CVE-2024-1383: WPvivid Backup for MainWP XSS Vulnerability

CVE-2024-1383 Overview

CVE-2024-1383 is a reflected cross-site scripting (XSS) vulnerability in the WPvivid Backup for MainWP plugin for WordPress. The flaw affects all versions up to and including 0.9.32 and stems from insufficient input sanitization and output escaping on the id parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). CVE-2024-35664 is likely a duplicate of this issue.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser session, enabling session token theft, administrative action forgery, and site defacement against MainWP dashboard users.

Affected Products

WPvivid Backup for MainWP plugin for WordPress
All versions up to and including 0.9.32
WordPress sites running MainWP with the affected plugin installed

Discovery Timeline

2024-03-13 - CVE-2024-1383 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1383

Vulnerability Analysis

The vulnerability resides in the WPvivid Backup for MainWP plugin, an add-on used by administrators managing multiple WordPress sites through the MainWP dashboard. The plugin reads the id parameter from an HTTP request and reflects its value into rendered page output without applying proper sanitization or output escaping.

Because the value passes through the response unchanged, an attacker can craft a URL containing malicious JavaScript in the id parameter. When a MainWP user visits the crafted link, the injected script executes in the browser under the origin of the vulnerable site. This grants the attacker access to cookies, session tokens, and any actions the victim is authorized to perform.

Exploitation requires user interaction, typically achieved through phishing or a malicious link embedded on an attacker-controlled page. Because the attack changes scope, the injected script can affect resources beyond the vulnerable component.

Root Cause

The plugin fails to call WordPress sanitization functions such as sanitize_text_field() on the incoming id parameter and does not apply esc_html() or esc_attr() when echoing the value into the response. The insecure handling can be reviewed in the WordPress Plugin Code Review at line 525 of wpvivid-backup-mainwp.php.

Attack Vector

The attack is network-based and requires no authentication. An attacker crafts a URL to the vulnerable endpoint with a JavaScript payload in the id query parameter. The attacker then delivers the link to an authenticated MainWP user through email, chat, or a malicious webpage. When the victim clicks the link, the reflected payload executes in the victim's session context.

The vulnerability manifests when the id parameter is echoed back into the page without escaping. See the Wordfence Vulnerability Report for additional technical detail on the reflection sink.

Detection Methods for CVE-2024-1383

Indicators of Compromise

HTTP requests to WPvivid Backup for MainWP endpoints containing <script>, javascript:, onerror=, or encoded variants in the id parameter
Referrer headers pointing to unfamiliar external domains preceding administrator sessions
Unexpected outbound requests from administrator browsers to attacker-controlled hosts following link clicks
Anomalous administrative actions performed from valid sessions shortly after link interaction

Detection Strategies

Inspect web server access logs for id parameter values containing HTML entities, script tags, or URL-encoded JavaScript payloads
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns targeting MainWP plugin endpoints
Monitor Content Security Policy (CSP) violation reports for inline script executions on WordPress administrative pages
Correlate suspicious query strings with administrator user-agent activity in SIEM platforms

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress front controller and retain logs for retrospective analysis
Alert on outbound connections from administrator workstations to newly observed domains
Track plugin version inventory across managed WordPress sites and flag installations of WPvivid Backup for MainWP at or below 0.9.32
Review MainWP audit logs for unexpected configuration changes or backup operations

How to Mitigate CVE-2024-1383

Immediate Actions Required

Update the WPvivid Backup for MainWP plugin to a version above 0.9.32 on all managed WordPress installations
Audit MainWP administrator accounts for unexpected activity dating back to plugin installation
Rotate WordPress administrator credentials and invalidate active sessions if suspicious activity is identified
Restrict access to MainWP dashboards using IP allowlists or VPN gating where feasible

Patch Information

The vendor addressed the flaw in a patched release. Review the fix in the WordPress Plugin Change Set which applies sanitization and escaping to the vulnerable id parameter handling.

Workarounds

Deactivate the WPvivid Backup for MainWP plugin until the patched version is deployed
Deploy WAF rules to block requests containing script tags or JavaScript event handlers in the id parameter
Enforce a strict Content Security Policy that disallows inline scripts on MainWP administrative pages
Train administrators to avoid clicking untrusted links while authenticated to WordPress or MainWP dashboards

bash

# Example WAF rule (ModSecurity) blocking reflected XSS in the 'id' parameter
SecRule ARGS:id "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002024,phase:2,deny,status:403,msg:'CVE-2024-1383 XSS attempt in id parameter'"