CVE-2024-27960: Email Subscription Popup XSS Vulnerability

CVE-2024-27960 Overview

CVE-2024-27960 is a stored Cross-Site Scripting (XSS) vulnerability in the I Thirteen Web Solution Email Subscription Popup plugin for WordPress. The flaw affects all versions up to and including 1.2.20. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject persistent script payloads. The issue is tracked under CWE-79 and documented in the Patchstack XSS Vulnerability Report.

Critical Impact
Attackers can inject persistent JavaScript into WordPress pages served by the plugin, enabling session hijacking, credential theft, and administrative account takeover when a privileged user views the affected content.

Affected Products

I Thirteen Web Solution Email Subscription Popup plugin for WordPress
All versions from unspecified initial release through 1.2.20
WordPress sites using the email-subscribe plugin package

Discovery Timeline

2024-03-17 - CVE-2024-27960 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27960

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under CWE-79. The Email Subscription Popup plugin accepts input intended for display within subscription popup content or administrative configuration fields. The plugin renders this input in generated web pages without adequate output encoding or input sanitization. Because the malicious payload persists in the WordPress database, every visitor who loads an affected page executes the attacker's script in the context of the site origin. The attack requires user interaction, since a victim must load the page containing the injected payload for execution to occur.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin does not apply WordPress escaping primitives such as esc_html(), esc_attr(), or wp_kses() to user-controlled fields before rendering them into HTML. When an attacker supplies input containing HTML or JavaScript, the browser parses and executes the payload as active content rather than treating it as inert text.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker with the ability to submit input to a vulnerable field, either through an unauthenticated form surface or a low-privilege authenticated account, stores a malicious payload in the database. A visitor or administrator later loads the affected page, at which point the injected script executes in their browser session. Because the attack scope is changed, the script runs against the trust context of the WordPress origin, enabling theft of session cookies, forced administrative actions, or redirection to attacker-controlled infrastructure. See the Patchstack advisory for public technical details.

No verified proof-of-concept code has been published for CVE-2024-27960. Refer to the vendor advisory for reproduction details.

Detection Methods for CVE-2024-27960

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= and onload= stored in Email Subscription Popup configuration or subscriber records within the WordPress database.
Outbound browser requests from site visitors to unknown third-party domains loaded from pages rendered by the plugin.
New or unexpected WordPress administrator accounts created shortly after administrators viewed pages containing plugin-rendered content.

Detection Strategies

Query WordPress database tables associated with the plugin for suspicious HTML markup, particularly <script, onerror, onload, and encoded variants such as <script.
Inspect HTTP response bodies from pages that embed the subscription popup for script content not authored by site operators.
Review web application firewall logs for POST requests containing XSS payload signatures targeting plugin endpoints.

Monitoring Recommendations

Enable a Content Security Policy (CSP) with reporting to surface script execution from unexpected sources.
Monitor WordPress wp-admin sessions for anomalous privilege changes, plugin installations, or user creation events.
Track integrity of plugin files and database rows containing user-supplied configuration content.

How to Mitigate CVE-2024-27960

Immediate Actions Required

Deactivate the Email Subscription Popup plugin on any WordPress site running version 1.2.20 or earlier until a fixed release is applied.
Audit stored plugin configuration and subscriber records, removing any entries containing HTML or JavaScript payloads.
Rotate WordPress administrator credentials and invalidate active sessions if evidence of exploitation is present.

Patch Information

At the time of NVD publication, no fixed version was listed for the plugin. Consult the Patchstack advisory and the WordPress plugin repository for the latest release status. Upgrade to a version released after 1.2.20 that explicitly addresses the XSS issue once available.

Workarounds

Remove the plugin entirely and replace it with an actively maintained email subscription alternative.
Deploy a web application firewall rule blocking requests to plugin endpoints that contain script tags or JavaScript event handlers.
Enforce a strict Content Security Policy that disallows inline script execution on pages rendering plugin output.

bash

# Example WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate email-subscribe
wp plugin uninstall email-subscribe