CVE-2024-24889 Overview
CVE-2024-24889 is a stored cross-site scripting (XSS) vulnerability in the Geek Code Lab All 404 Pages Redirect to Homepage WordPress plugin. The flaw affects all plugin versions up to and including 1.9. An unauthenticated attacker can inject malicious script content that is later executed in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79 for improper neutralization of input during web page generation. Patchstack published details of the issue in its vulnerability database.
Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute in administrator sessions, enabling account takeover, session hijacking, and further compromise of the WordPress site.
Affected Products
- Geek Code Lab All 404 Pages Redirect to Homepage plugin for WordPress
- All plugin versions up to and including 1.9
- WordPress sites running the vulnerable plugin with default configuration
Discovery Timeline
- 2024-02-12 - CVE-2024-24889 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24889
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input before it is rendered in HTML responses generated by the plugin. The plugin fails to sanitize or encode input handled by its request processing logic, allowing attacker-controlled data to be persisted and later reflected in the page markup. Because the payload is stored server-side, every subsequent visitor to the affected page triggers execution of the injected script.
The attack requires no authentication, which broadens the attacker population to any remote user who can reach the WordPress site. User interaction is required, meaning a victim must load the compromised page for the payload to fire. Successful exploitation runs script in the origin of the WordPress site, granting access to cookies, session tokens, and any state accessible to the victim's browser.
Root Cause
The root cause is missing output encoding and input validation on data fields processed by the plugin. The plugin trusts input that should be treated as untrusted and writes it directly into HTML context without applying WordPress sanitization APIs such as esc_html(), esc_attr(), or wp_kses(). This maps directly to CWE-79, Improper Neutralization of Input During Web Page Generation.
Attack Vector
A remote attacker submits a crafted request containing an HTML or JavaScript payload to a plugin-controlled input handler. The plugin stores the payload, and it is subsequently rendered without encoding when a user, typically an administrator reviewing site activity, loads the affected page. The script then executes in the victim's browser under the WordPress site's origin. Consult the Patchstack XSS Vulnerability Report for the specific injection point.
Detection Methods for CVE-2024-24889
Indicators of Compromise
- WordPress database entries associated with the plugin containing <script>, onerror=, onload=, or javascript: substrings.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading WordPress admin pages.
- New or modified WordPress administrator accounts appearing without a corresponding legitimate login event.
- Web server access logs showing POST requests to plugin endpoints from unauthenticated clients containing HTML entities or encoded script payloads.
Detection Strategies
- Inventory WordPress installations and identify sites running all-404-pages-redirect-to-homepage at version 1.9 or earlier.
- Inspect the wp_options and plugin-specific database tables for stored values that contain HTML tags or script content.
- Review web application firewall (WAF) logs for XSS signatures targeting plugin request parameters.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin setting changes and administrator activity.
- Forward WordPress and web server logs to a centralized SIEM for correlation with browser-side telemetry.
- Alert on administrator session anomalies, including new API tokens, unexpected role changes, and cookie theft indicators.
How to Mitigate CVE-2024-24889
Immediate Actions Required
- Update the All 404 Pages Redirect to Homepage plugin to a version later than 1.9 as soon as a fixed release is available from Geek Code Lab.
- If no patched version is available, deactivate and remove the plugin from all affected WordPress installations.
- Rotate WordPress administrator credentials and invalidate active sessions after remediation.
- Audit plugin-managed database entries and remove any injected script content.
Patch Information
At the time of publication, the advisory identifies versions through 1.9 as vulnerable. Administrators should monitor the plugin listing on WordPress.org and the Patchstack advisory for a fixed release, then apply the update through the WordPress plugin manager.
Workarounds
- Deploy a WAF rule that blocks requests containing HTML tags or JavaScript event handlers targeting plugin endpoints.
- Restrict access to the WordPress admin interface using IP allowlisting or a reverse proxy authentication layer.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts and limits script sources to trusted origins.
- Remove the plugin entirely and replace 404 handling with a lightweight functions.php redirect or a maintained alternative plugin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.