CVE-2024-29763 Overview
CVE-2024-29763 is a reflected Cross-Site Scripting (XSS) vulnerability in the realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) plugin. The flaw affects all plugin versions from initial release through 1.3.3. It stems from improper neutralization of user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in a victim's browser. The vulnerability is tracked under [CWE-79]. Exploitation requires user interaction, such as clicking a crafted link, and can result in session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim.
Critical Impact
Attackers can execute arbitrary JavaScript in the context of a victim's browser session on affected WordPress sites, enabling account hijacking and administrative privilege abuse when logged-in users are targeted.
Affected Products
- WordPress Meta Data and Taxonomies Filter (MDTF) plugin by realmag777
- All versions from initial release through 1.3.3
- WordPress sites with the vulnerable plugin installed and enabled
Discovery Timeline
- 2024-03-27 - CVE-2024-29763 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29763
Vulnerability Analysis
The MDTF plugin fails to properly sanitize and encode user-controllable input before reflecting it into HTTP responses. When a crafted request reaches a vulnerable endpoint, the input is written into the rendered page without contextual output encoding. A browser then parses the injected content as executable JavaScript. This is a classic reflected XSS pattern where the attack payload travels in the request and is echoed back in the immediate response, requiring the victim to interact with an attacker-controlled link.
The scope-changed impact means the injected script can affect resources beyond the vulnerable component itself, including other browser contexts and cookies accessible from the WordPress origin. Attackers commonly leverage such flaws to steal authentication cookies, perform actions as an authenticated administrator, or pivot to plugin-level configuration changes.
Root Cause
The root cause is missing or insufficient input neutralization in one or more request handlers exposed by the MDTF plugin. Parameters that should be escaped for HTML, attribute, or JavaScript contexts are instead concatenated into the response body. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses() for this purpose, and their absence or misuse produces the reflected XSS condition described in the Patchstack XSS Vulnerability Advisory.
Attack Vector
Exploitation is network-based and requires no authentication. An attacker crafts a URL containing a malicious payload targeting a vulnerable MDTF parameter, then delivers the link through phishing, malicious advertising, or a compromised third-party site. When a victim, ideally an authenticated WordPress administrator, opens the link, the injected script executes in their browser under the site's origin. Technical exploitation details are documented in the referenced Patchstack advisory.
Detection Methods for CVE-2024-29763
Indicators of Compromise
- Unusual outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the WordPress site.
- Web server access logs showing requests to MDTF plugin endpoints containing <script>, javascript:, onerror=, or URL-encoded equivalents.
- Unexpected creation of WordPress administrator accounts or modification of plugin and theme files.
- Suspicious session activity or cookie theft events originating from WordPress admin sessions.
Detection Strategies
- Inspect HTTP request parameters targeting MDTF endpoints for HTML tags, event handlers, and encoded script fragments.
- Deploy a Web Application Firewall (WAF) with signatures for reflected XSS payload patterns and monitor blocked events.
- Correlate referer headers with outbound HTTP traffic to identify browser sessions that loaded crafted links.
- Review WordPress audit logs for privileged actions performed shortly after known-suspect page loads.
Monitoring Recommendations
- Ingest WordPress access logs, WAF alerts, and browser telemetry into a centralized analytics platform for correlation.
- Alert on repeated requests to MDTF filter endpoints containing script-like content from a single source IP.
- Track new administrator account creation and plugin file modifications as high-severity events.
- Monitor for anomalous admin session behavior, including logins from new geolocations or user agents.
How to Mitigate CVE-2024-29763
Immediate Actions Required
- Identify all WordPress installations running MDTF version 1.3.3 or earlier and prioritize remediation.
- Apply the vendor-supplied update to a version later than 1.3.3 once available, per the Patchstack XSS Vulnerability Advisory.
- Force password resets and invalidate active sessions for administrator accounts if exploitation is suspected.
- Review recent administrator actions, installed plugins, and modified files for signs of abuse.
Patch Information
The vulnerability affects MDTF versions through 1.3.3. Site owners should upgrade to a fixed release published after 1.3.3 when the vendor issues one. Consult the referenced Patchstack advisory for the current patch status and remediation guidance. If no fixed version is available, deactivate and remove the plugin until a patched release is published.
Workarounds
- Disable and uninstall the MDTF plugin until a patched version is confirmed by the vendor.
- Deploy a WAF rule that blocks requests to MDTF endpoints containing HTML tags, event handlers, or javascript: schemes.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
- Restrict WordPress administrator access to trusted networks and require multi-factor authentication for privileged accounts.
# Example WAF rule fragment (ModSecurity) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
"id:1029763,phase:2,deny,status:403,log,msg:'Potential XSS targeting MDTF plugin (CVE-2024-29763)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
