CVE-2024-29928: Advanced Sermons Reflected XSS Vulnerability

CVE-2024-29928 Overview

CVE-2024-29928 is a reflected Cross-Site Scripting (XSS) vulnerability in the WP Codeus Advanced Sermons plugin for WordPress. The flaw affects all versions of the plugin up to and including version 3.1. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in a victim's browser session. This weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Successful exploitation allows attackers to execute arbitrary scripts in the context of an authenticated user's browser, enabling session theft, credential harvesting, and unauthorized actions on the affected WordPress site.

Affected Products

• WP Codeus Advanced Sermons plugin for WordPress
• All versions from n/a through 3.1
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2024-03-27 - CVE-2024-29928 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29928

Vulnerability Analysis

The Advanced Sermons plugin processes user-supplied input and reflects it back into HTTP responses without proper output encoding or input sanitization. When a victim clicks a specially crafted URL, the injected payload renders as part of the returned HTML page. The browser then interprets the payload as legitimate script content and executes it within the site's origin.

The vulnerability requires user interaction, as the attacker must convince the victim to visit a malicious link. Because the attack crosses a security scope boundary, injected scripts can access resources beyond the vulnerable component. Attackers commonly deliver reflected XSS payloads through phishing emails, malicious advertisements, or compromised third-party sites.

Root Cause

The root cause is missing input validation and output encoding within the Advanced Sermons plugin request handlers. Parameters received via HTTP requests are inserted into HTML responses without being escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This allows characters like <, >, and " to break out of intended contexts and introduce executable script tags or event handlers.

Attack Vector

An unauthenticated remote attacker crafts a URL containing a malicious JavaScript payload targeting a vulnerable plugin endpoint. The attacker then distributes the URL to potential victims. When a WordPress administrator or authenticated user visits the crafted URL, the payload executes in their browser with the privileges of their active session. Attackers can steal session cookies, perform actions as the victim, or pivot to further compromise the WordPress installation. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-29928

Indicators of Compromise

• HTTP requests to Advanced Sermons plugin endpoints containing script tags, javascript: schemes, or HTML event handlers such as onerror= and onload=
• URL parameters containing encoded payloads with %3Cscript%3E or similar variants
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin URLs
• WordPress access logs showing referrers from phishing or unfamiliar external sites

Detection Strategies

• Inspect web server access logs for query strings targeting Advanced Sermons endpoints with suspicious characters like <, >, or "
• Deploy a Web Application Firewall (WAF) with signatures for reflected XSS payloads against WordPress plugin paths
• Enable Content Security Policy (CSP) reporting to identify inline script violations originating from plugin-rendered pages

Monitoring Recommendations

• Monitor administrative account activity for anomalous session usage, unexpected plugin installs, or new administrator accounts
• Correlate browser-side telemetry with WordPress audit logs to detect script execution tied to plugin URLs
• Track failed login attempts and session token reuse from geographically inconsistent locations

How to Mitigate CVE-2024-29928

Immediate Actions Required

• Deactivate the Advanced Sermons plugin until a patched version confirmed to remediate CVE-2024-29928 is available
• Audit WordPress administrator accounts and rotate credentials for any user who may have interacted with suspicious links
• Invalidate active sessions and force re-authentication for privileged users
• Review installed plugins and remove any that are unmaintained or no longer required

Patch Information

At the time of publication, no vendor-supplied fixed version is referenced in the NVD entry. The advisory covers Advanced Sermons versions up to and including 3.1. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for updated releases.

Workarounds

• Block or filter requests to vulnerable plugin endpoints using a WAF rule that rejects script tags and JavaScript event handlers in query parameters
• Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
• Restrict access to the WordPress admin interface using IP allow-listing or VPN-only access
• Enable multi-factor authentication for all administrator accounts to limit the impact of stolen session tokens

# Example WAF rule (ModSecurity) blocking script payloads on plugin paths
SecRule REQUEST_URI "@contains /wp-content/plugins/advanced-sermons/" \
    "chain,id:1029928,phase:2,deny,status:403,msg:'Blocked potential XSS against Advanced Sermons'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"