CVE-2024-29099 Overview
CVE-2024-29099 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Evergreen Content Poster WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. All versions of the plugin from initial release through 1.4.1 are affected. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session under the context of the vulnerable WordPress site.
Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions against WordPress administrators through crafted links delivered via phishing or malicious referrers.
Affected Products
- Evergreen Content Poster WordPress plugin versions through 1.4.1
- WordPress installations with the plugin active and reachable over the network
- Sites where administrators or privileged users may interact with attacker-supplied links
Discovery Timeline
- 2024-03-19 - CVE-2024-29099 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29099
Vulnerability Analysis
The vulnerability is a reflected XSS issue in the Evergreen Content Poster plugin for WordPress. User-controlled input is reflected back into the HTTP response without proper output encoding or contextual sanitization. When a victim visits an attacker-crafted URL, the injected script executes within the browser under the origin of the vulnerable WordPress site.
Because the flaw is reflected rather than stored, exploitation requires user interaction (UI:R). However, the scope is changed (S:C), meaning the injected script can access resources beyond the vulnerable component's security boundary, including cookies and DOM contents of the hosting WordPress site.
Root Cause
The plugin fails to apply appropriate escaping functions such as WordPress core helpers esc_html(), esc_attr(), or wp_kses() before writing request parameters into rendered HTML. Input passed via query string or form parameters flows directly to the response body, allowing HTML and JavaScript payloads to be interpreted by the browser.
Attack Vector
Exploitation follows a standard reflected XSS chain. An attacker constructs a URL targeting the vulnerable plugin endpoint with a JavaScript payload embedded in a reflected parameter. The attacker delivers the URL through phishing email, social media, or a malicious referring site. When an authenticated WordPress user clicks the link, the payload executes in their browser session and can perform actions on their behalf, exfiltrate cookies, or pivot to administrative functionality.
Refer to the Patchstack Vulnerability Report for technical details on the vulnerable parameter and payload construction.
Detection Methods for CVE-2024-29099
Indicators of Compromise
- HTTP request logs containing URL parameters with encoded or raw <script>, onerror=, onload=, or javascript: payloads targeting Evergreen Content Poster plugin endpoints
- Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after visits to the WordPress site
- WordPress access logs showing suspicious Referer headers or long, obfuscated query strings directed at plugin PHP files
Detection Strategies
- Deploy a Web Application Firewall (WAF) with rules that flag reflected XSS payload signatures in query parameters targeting /wp-content/plugins/evergreen-content-poster/ paths
- Review WordPress access logs for anomalous query strings containing HTML entities, script tags, or JavaScript URI schemes
- Monitor for administrator account activity originating from unusual IP addresses or immediately following unusual referrer traffic
Monitoring Recommendations
- Enable verbose access logging on the web server and forward logs to a centralized analytics platform for retention and query
- Alert on POST or GET requests to plugin endpoints containing payload markers such as %3Cscript, onerror%3D, or javascript%3A
- Correlate WordPress wp_login events with preceding suspicious referrer or query-string activity to identify successful session hijacks
How to Mitigate CVE-2024-29099
Immediate Actions Required
- Update the Evergreen Content Poster plugin to a version later than 1.4.1 if the vendor has published a patched release
- If no patched release is available, deactivate and remove the plugin from all WordPress installations
- Force password resets and invalidate active sessions for administrator accounts that may have interacted with untrusted links
Patch Information
The advisory documents the vulnerability as affecting versions through 1.4.1. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed version and update accordingly.
Workarounds
- Place the WordPress site behind a WAF configured with OWASP Core Rule Set protections against reflected XSS
- Restrict access to WordPress administrative interfaces by IP allowlist or VPN to reduce the attack surface for privileged users
- Enforce Content Security Policy (CSP) headers that disallow inline script execution to blunt payload effectiveness
- Train administrators to avoid clicking unsolicited links referencing the WordPress site's domain
# Example CSP header to mitigate reflected XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
