CVE-2024-13839: WordPress Staff Directory XSS Vulnerability

CVE-2024-13839 Overview

CVE-2024-13839 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Staff Directory Plugin: Company Directory plugin for WordPress. The flaw affects all versions up to and including 4.3. It stems from the use of the add_query_arg function without appropriate escaping on the URL. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Successful exploitation can lead to session theft, unauthorized actions in the victim's browser context, and delivery of secondary payloads.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in an authenticated administrator's browser by convincing them to click a malicious link, enabling session hijacking or privileged actions on the WordPress site.

Affected Products

Staff Directory Plugin: Company Directory for WordPress — all versions ≤ 4.3
WordPress installations with the staff-directory-pro plugin active
Sites exposing the vulnerable plugin endpoints to unauthenticated users

Discovery Timeline

2025-03-05 - CVE-2024-13839 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13839

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting issue in the Staff Directory Plugin: Company Directory for WordPress. The plugin invokes WordPress's add_query_arg helper to append or modify query string parameters on the current request URL. When the returned URL is later rendered back into an HTML response without escaping, attacker-controlled input from the request is reflected into the page. Because the reflection occurs in an HTML context without output encoding, injected <script> payloads execute in the browser of anyone who follows the crafted link.

Exploitation requires user interaction — a victim must click a link or visit a page under the attacker's control. However, no authentication is needed to construct or trigger the payload. The scope change indicated by the vulnerability metrics reflects that script executing in the WordPress admin origin can affect resources beyond the vulnerable component itself.

Root Cause

The root cause is missing output escaping on the return value of add_query_arg. WordPress documentation explicitly notes that this function does not sanitize its output and warns that returned values must be passed through esc_url or esc_url_raw before being placed into HTML. The plugin omits this escaping step, allowing reflected input from the current request URI to be written directly into the DOM. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report #80203516 for the vulnerable code path.

Attack Vector

An attacker crafts a URL targeting a vulnerable plugin page and appends a malicious query string parameter containing JavaScript. The attacker distributes this link via phishing, forum posts, or advertising. When an authenticated WordPress administrator clicks the link, the reflected payload executes in the admin's browser session, allowing theft of authentication cookies, forced administrative actions, or injection of persistent backdoors through follow-on requests.

The vulnerability is described in prose only; no verified proof-of-concept code is published. Refer to the Wordfence advisory for additional technical detail.

Detection Methods for CVE-2024-13839

Indicators of Compromise

Web server access logs containing requests to staff-directory-pro endpoints with query strings that include URL-encoded <script>, javascript:, onerror=, or onload= fragments.
Referrer headers on WordPress admin sessions originating from unexpected external domains immediately preceding privileged actions.
Newly created WordPress administrator accounts or unexpected plugin installations following admin visits to crafted links.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string parameters targeting the staff-directory-pro plugin path for HTML metacharacters and script keywords.
Correlate outbound clicks from corporate email or messaging platforms against inbound requests to WordPress admin URLs containing suspicious query strings.
Review the plugin version installed across managed WordPress sites and flag any instance at version 4.3 or earlier.

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress hosts and forward logs to a centralized SIEM for query string analysis.
Monitor for anomalous administrator actions such as user role changes, plugin uploads, or theme edits following admin browser sessions.
Alert on browser Content Security Policy (CSP) violations reported from WordPress admin pages, which can indicate reflected script execution attempts.

How to Mitigate CVE-2024-13839

Immediate Actions Required

Update the Staff Directory Plugin: Company Directory to a version above 4.3 as soon as the vendor publishes a patched release.
If no patched version is available, deactivate and remove the staff-directory-pro plugin from all WordPress installations.
Force logout of all WordPress administrators and rotate session secrets to invalidate any cookies potentially exposed through prior exploitation.

Patch Information

At the time of publication, review the WordPress Staff Directory Pro plugin page for the latest release notes and any security-fixed version. Administrators should confirm the installed version is later than 4.3 and validate the fix by reviewing the plugin's use of esc_url around calls to add_query_arg.

Workarounds

Restrict access to WordPress admin URLs by IP allowlisting at the web server or WAF layer to reduce click-through exposure.
Deploy a strict Content Security Policy that disallows inline script execution on WordPress admin pages.
Train administrators to avoid clicking unsolicited links that reference their WordPress site's domain and query parameters.

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate staff-directory-pro
wp plugin delete staff-directory-pro

# Example nginx rule to block obvious XSS payloads targeting the plugin path
# location ~* /wp-content/plugins/staff-directory-pro/ {
#     if ($args ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
#         return 403;
#     }
# }