CVE-2024-1852: WP-Members Plugin XSS Vulnerability

CVE-2024-1852 Overview

CVE-2024-1852 is a stored Cross-Site Scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress. The flaw affects all versions up to and including 3.4.9.2 and stems from insufficient input sanitization and output escaping of the X-Forwarded-For HTTP header. Unauthenticated attackers can inject arbitrary JavaScript that executes when an administrator or privileged user views the affected edit users page. The Wordfence advisory tracks this issue under Common Weakness Enumeration [CWE-79]. The vendor released a partial fix in version 3.4.9.2 and a complete fix in 3.4.9.3.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into the WordPress edit users page by manipulating the X-Forwarded-For header, enabling session theft, administrative action forgery, and further site compromise when an administrator visits the page.

Affected Products

Butlerblog WP-Members Membership Plugin for WordPress, all versions up to and including 3.4.9.2
WordPress sites where the plugin trusts client-supplied X-Forwarded-For values
Partially patched in 3.4.9.2; fully patched in 3.4.9.3

Discovery Timeline

2024-04-09 - CVE-2024-1852 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1852

Vulnerability Analysis

The WP-Members plugin captures the client IP address to log user activity in administrative views. Instead of relying solely on the server-populated REMOTE_ADDR, the plugin reads the X-Forwarded-For HTTP header, which is entirely attacker-controlled. The plugin stores this value and later renders it on the edit users page without adequate escaping. When a WordPress administrator opens the profile of a user whose IP was recorded from a malicious request, the injected script executes in the administrator's browser session.

Because the sink is an authenticated administrative page, successful exploitation grants the attacker script execution in a high-privilege context. Consequences include session token theft, creation of new administrator accounts through forged REST requests, plugin or theme modification, and pivoting into further WordPress-level compromise.

Root Cause

The root cause is missing input sanitization on ingestion and missing output escaping on rendering. The plugin treats X-Forwarded-For as trusted data and stores it verbatim. When the edit users page later prints this value, it does not apply esc_html() or esc_attr(), so HTML and JavaScript content in the header is interpreted by the browser. This is a textbook stored XSS pattern rooted in the confusion between raw request data and safe output.

Attack Vector

An unauthenticated remote attacker sends any HTTP request that WP-Members processes, such as a login or registration endpoint, and sets an X-Forwarded-For header containing a JavaScript payload. The plugin persists the header value in the database. When an administrator later views the affected user's profile in wp-admin, the payload renders and executes. Exploitation requires no authentication from the attacker but does require a privileged user to view the injected page, which explains the User Interaction requirement in the scoring.

The underlying implementation can be reviewed in the plugin source at class-wp-members-user-profile.php line 566, class-wp-members-user.php line 524, and the utilities helper at rocketgeek-utilities/includes/utilities.php line 168. See the Wordfence Vulnerability Analysis for detailed sink and source references.

Detection Methods for CVE-2024-1852

Indicators of Compromise

HTTP requests to WordPress endpoints containing <script>, onerror=, onload=, or JavaScript URI schemes inside the X-Forwarded-For header.
WordPress user metadata or plugin log entries where the stored IP field contains HTML tags or event handlers instead of a valid IPv4 or IPv6 address.
Unexpected new administrator accounts, modified user roles, or plugin/theme changes shortly after an administrator visits wp-admin/user-edit.php.
Outbound requests from administrator browsers to unfamiliar domains immediately after opening a user profile.

Detection Strategies

Inspect WordPress and reverse proxy access logs for X-Forwarded-For values that do not match an IP address regex.
Query the wp_usermeta table for stored IP fields written by WP-Members and flag rows containing angle brackets, quotes, or javascript:.
Deploy a Web Application Firewall (WAF) rule that blocks non-IP content in the X-Forwarded-For header before it reaches PHP.

Monitoring Recommendations

Alert on script-like content in any HTTP header field on WordPress hosts.
Monitor creation of WordPress administrator accounts and role escalations, correlating with recent visits to user edit pages.
Track WP-Members plugin version across all managed WordPress sites and flag anything below 3.4.9.3.

How to Mitigate CVE-2024-1852

Immediate Actions Required

Update the WP-Members Membership Plugin to version 3.4.9.3 or later on every WordPress site in the environment.
Audit wp_usermeta for stored IP values containing HTML or script content and sanitize or remove offending entries.
Review recent administrator activity, session tokens, and newly created accounts for signs of exploitation, and rotate credentials for any account that opened an affected user profile.

Patch Information

Butlerblog released 3.4.9.2 with a partial fix and 3.4.9.3 with the complete fix that properly sanitizes and escapes the X-Forwarded-For value before storage and output. Site administrators should install 3.4.9.3 or later through the WordPress plugin updater. Confirm the installed version by checking the plugin file header or the wp-admin/plugins.php listing.

Workarounds

Configure the upstream reverse proxy or WAF to strip or overwrite the X-Forwarded-For header from external clients so only trusted proxies can set it.
Disable the WP-Members plugin until it can be updated if immediate patching is not possible.
Restrict access to wp-admin by IP allowlist to reduce the chance that an administrator triggers a stored payload from an untrusted source.

bash

# Example nginx configuration to sanitize X-Forwarded-For from untrusted clients
# Only accept X-Forwarded-For from known upstream proxies; otherwise clear it.
http {
    map $remote_addr $trusted_xff {
        default          "";
        10.0.0.0/8       $http_x_forwarded_for;
        192.168.0.0/16   $http_x_forwarded_for;
    }

    server {
        listen 443 ssl;
        server_name example.com;

        location / {
            proxy_set_header X-Forwarded-For $trusted_xff;
            proxy_set_header X-Real-IP       $remote_addr;
            proxy_pass http://wordpress_backend;
        }
    }
}