CVE-2024-1782: Blue Triad EZAnalytics XSS Vulnerability

CVE-2024-1782 Overview

CVE-2024-1782 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Blue Triad EZAnalytics plugin for WordPress. The flaw affects all versions up to and including 1.0. Attackers can inject arbitrary web scripts through the bt_webid parameter due to insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can exploit this issue by tricking a user into clicking a crafted link. The injected script executes in the victim's browser under the WordPress site's origin.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and administrative account takeover on affected WordPress sites.

Affected Products

Blue Triad EZAnalytics plugin for WordPress, all versions through 1.0
WordPress sites running the jbahlquist/blue_triad_ezanalytics component
Any WordPress installation with the vulnerable plugin activated

Discovery Timeline

2024-03-05 - CVE-2024-1782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1782

Vulnerability Analysis

The Blue Triad EZAnalytics plugin processes the bt_webid request parameter and reflects its value into the HTTP response without adequate sanitization or output encoding. An attacker crafts a URL containing malicious JavaScript in the bt_webid parameter and lures a victim into visiting it. The victim's browser then executes the attacker-controlled script in the context of the WordPress site.

The vulnerability requires user interaction to succeed. Impact scope changes because injected script executes outside the vulnerable component boundary, affecting other browser origins and session data. Successful exploitation permits attackers to steal authentication cookies, perform actions on behalf of the victim, or redirect users to phishing pages.

Root Cause

The root cause is missing input validation and missing output escaping when handling the bt_webid GET parameter. The plugin echoes user-supplied data into HTML output without applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses(). This classifies as a classic Improper Neutralization of Input During Web Page Generation flaw [CWE-79].

Attack Vector

Exploitation occurs over the network without authentication. The attacker constructs a URL targeting a page that processes bt_webid and embeds a JavaScript payload in that parameter. The attacker delivers the URL through phishing email, malicious advertising, social media, or a compromised third-party site. When the victim clicks the link, the malicious script executes in their browser with the privileges of the WordPress origin.

Because the payload runs in the victim's browser context, an attacker who lures an authenticated administrator can perform privileged actions such as creating new admin accounts, modifying plugin settings, or injecting persistent backdoors. See the Wordfence Vulnerability Report and WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2024-1782

Indicators of Compromise

Web server access logs containing requests to plugin endpoints with bt_webid parameter values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unexpected creation of WordPress administrator accounts or modifications to user roles following user visits to plugin pages.
Referrer headers from external phishing domains directing traffic to WordPress pages that render the vulnerable parameter.

Detection Strategies

Deploy web application firewall rules that inspect the bt_webid query parameter for HTML tags, event handlers, and script protocol handlers.
Correlate outbound HTTP requests from browsers to attacker-controlled infrastructure with prior visits to WordPress pages containing reflected parameters.
Review WordPress audit logs for administrative actions occurring shortly after suspicious inbound clicks on plugin URLs.

Monitoring Recommendations

Alert on HTTP requests where query string parameters contain encoded or raw JavaScript patterns targeting the affected plugin path.
Monitor endpoint browser telemetry for script execution originating from WordPress admin sessions that spawn unexpected credential access or account changes.
Track user-agent and geographic anomalies for admin authentication events following inbound clicks from external referrers.

How to Mitigate CVE-2024-1782

Immediate Actions Required

Deactivate and remove the Blue Triad EZAnalytics plugin from all WordPress installations until a patched version is confirmed available.
Force password resets for all WordPress administrator and editor accounts on sites that ran the vulnerable plugin.
Audit user tables and installed plugins for unauthorized administrator accounts or modifications introduced through XSS-driven actions.

Patch Information

No vendor patch is referenced in the enriched CVE data. All versions up to and including 1.0 remain vulnerable. Site owners should monitor the WordPress Plugin Directory and the Wordfence Vulnerability Report for patch availability. Given the absence of a confirmed fix, removal remains the recommended action.

Workarounds

Configure a WAF or reverse proxy rule to block requests where bt_webid contains angle brackets, event handler keywords, or URL-encoded script tags.
Enforce a strict Content Security Policy header that disallows inline scripts and untrusted script sources to reduce the impact of reflected payloads.
Restrict access to WordPress admin pages by IP allowlisting to limit exposure of privileged sessions to XSS attacks.

bash

# Example nginx rule blocking script-like content in the bt_webid parameter
if ($arg_bt_webid ~* "(<|%3C)\s*script|javascript:|on\w+\s*=") {
    return 403;
}

# Example Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;