CVE-2024-29113: Metagauss RegistrationMagic XSS Vulnerability

CVE-2024-29113 Overview

CVE-2024-29113 is a reflected cross-site scripting (XSS) vulnerability in the Metagauss RegistrationMagic plugin for WordPress. The flaw affects all versions up to and including 5.2.5.9. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An unauthenticated attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when the link is clicked. Successful exploitation changes the security scope, allowing attackers to steal session data, perform actions on behalf of logged-in users, or redirect victims to attacker-controlled infrastructure.

Critical Impact
Reflected XSS enables session hijacking, credential theft, and administrative action abuse against authenticated WordPress users who click a crafted link.

Affected Products

Metagauss RegistrationMagic WordPress plugin versions up to and including 5.2.5.9
WordPress sites using the Custom Registration Form Builder with Submission Manager
Any site exposing RegistrationMagic endpoints to unauthenticated visitors

Discovery Timeline

2024-03-19 - CVE-2024-29113 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29113

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in RegistrationMagic. Input accepted through request parameters is reflected back into HTML responses without proper output encoding or sanitization. The scope-changed classification indicates that script execution impacts resources beyond the vulnerable component itself, such as the parent WordPress session context. Attackers deliver the payload through phishing links, malicious advertisements, or injected content on third-party sites. User interaction is required, since the victim must visit the crafted URL for the payload to execute.

Root Cause

The root cause is missing or insufficient output encoding on data reflected into HTML responses generated by the plugin. The affected code paths accept input through HTTP request parameters and emit that data into the response body without applying context-aware escaping functions such as WordPress esc_html(), esc_attr(), or esc_js(). See the Patchstack XSS Vulnerability Advisory for the specific parameter details.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting a vulnerable RegistrationMagic endpoint and embeds a JavaScript payload within a reflected parameter. The attacker distributes the URL through email, chat, or social media. When a victim clicks the link while visiting the WordPress site, the payload executes in the victim's browser under the site's origin. The payload can access cookies that are not marked HttpOnly, submit authenticated requests, or render fake login forms to harvest credentials.

Detection Methods for CVE-2024-29113

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or onload= substrings in RegistrationMagic query parameters
Encoded payloads using URL encoding (%3Cscript%3E) or HTML entity encoding targeting plugin endpoints
Unexpected outbound requests from administrator browser sessions following link clicks
WordPress audit log entries showing privileged actions performed from unusual referrer URLs

Detection Strategies

Inspect web server access logs for RegistrationMagic request parameters containing HTML or JavaScript metacharacters
Deploy a web application firewall (WAF) rule set that identifies reflected XSS payload patterns targeting the plugin paths
Monitor browser console errors and Content Security Policy violation reports from site administrators
Correlate referrer headers on sensitive admin actions against known-good internal navigation paths

Monitoring Recommendations

Centralize WordPress access and application logs for continuous review of plugin endpoint traffic
Alert on administrator sessions originating from external referrers immediately after clicking email links
Track plugin version inventory across WordPress deployments to confirm patched status
Monitor WordPress user role changes and content modifications for anomalies tied to XSS-based session abuse

How to Mitigate CVE-2024-29113

Immediate Actions Required

Update the RegistrationMagic plugin to the version released after 5.2.5.9 that remediates the issue
Audit administrator accounts for unauthorized changes made since the plugin was installed
Invalidate active WordPress sessions and force password resets for privileged users if exploitation is suspected
Advise administrators to avoid clicking inbound links to the WordPress admin panel from untrusted sources

Patch Information

Metagauss has addressed the vulnerability in versions released after 5.2.5.9. Review the Patchstack XSS Vulnerability Advisory for the fixed version number and apply the update through the WordPress plugin dashboard or wp-cli.

Workarounds

Deploy a WAF rule that blocks requests containing script tags or JavaScript event handlers directed at RegistrationMagic endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on WordPress authentication cookies to limit XSS impact
Temporarily disable the RegistrationMagic plugin on sites where patching cannot be performed immediately

bash

# Update RegistrationMagic using wp-cli
wp plugin update custom-registration-form-builder-with-submission-manager
wp plugin status custom-registration-form-builder-with-submission-manager