CVE-2024-33947: Metagauss RegistrationMagic XSS Vulnerability

CVE-2024-33947 Overview

CVE-2024-33947 is a reflected cross-site scripting (XSS) vulnerability in the Metagauss RegistrationMagic WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79]. All versions of RegistrationMagic up through 5.3.2.0 are affected. An attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser under the vulnerable site's origin. The scope is changed, meaning the injected script can affect resources beyond the initially vulnerable component. Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.

Critical Impact

Reflected XSS enables attackers to execute arbitrary JavaScript in a victim's browser, potentially compromising WordPress administrator sessions when an authenticated user follows a crafted link.

Affected Products

• Metagauss RegistrationMagic plugin for WordPress
• All versions from initial release through 5.3.2.0
• WordPress sites using the Custom Registration Form Builder with Submission Manager

Discovery Timeline

• 2024-05-03 - CVE-2024-33947 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33947

Vulnerability Analysis

CVE-2024-33947 is a reflected XSS vulnerability affecting the RegistrationMagic plugin on WordPress. The plugin fails to properly neutralize input passed into HTTP request parameters before echoing that input back into generated HTML responses. As a result, an attacker who can lure a target into clicking a maliciously crafted URL can inject arbitrary HTML or JavaScript into the rendered page.

Exploitation requires user interaction, but no authentication is needed on the attacker's side. Because the vulnerable component runs in the context of a WordPress site, a victim who is a logged-in administrator or high-privilege user exposes their session to the injected payload. That payload can perform actions on the site, exfiltrate cookies, or pivot into further compromise using WordPress REST API calls.

Root Cause

The root cause is missing or insufficient output encoding of request parameters processed by the RegistrationMagic plugin. User-controlled values reach an HTML rendering context without being escaped through WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This aligns with [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires the victim to click a crafted URL or visit an attacker-controlled page that triggers a request to the vulnerable endpoint. Because the vulnerability produces a scope change, the injected script can access resources across the WordPress origin, including admin-area functionality if the victim is authenticated. Detailed technical context is available in the Patchstack XSS Vulnerability Advisory.

No verified public proof-of-concept code is available. The vulnerability manifests when unsanitized request parameters are reflected into HTML responses generated by the plugin.

Detection Methods for CVE-2024-33947

Indicators of Compromise

• Web server access logs containing request parameters with HTML tags such as <script>, <img>, <svg>, or event handlers like onerror= and onload=
• Outbound requests from admin browser sessions to unfamiliar external domains shortly after visiting a RegistrationMagic page
• Unexpected creation of WordPress administrator accounts or modifications to user roles following user clicks on external links

Detection Strategies

• Inspect HTTP query strings and POST bodies sent to RegistrationMagic endpoints for URL-encoded script payloads and JavaScript event handlers
• Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns in requests targeting /wp-content/plugins/custom-registration-form-builder-with-submission-manager/ paths
• Correlate referer headers pointing to external sites with subsequent authenticated admin actions in WordPress audit logs

Monitoring Recommendations

• Enable WordPress activity logging to record administrator actions, plugin changes, and user role modifications
• Monitor the plugin version installed across managed WordPress sites and alert when versions 5.3.2.0 or earlier are detected
• Track browser Content Security Policy (CSP) violation reports to identify script injection attempts

How to Mitigate CVE-2024-33947

Immediate Actions Required

• Upgrade RegistrationMagic to a version released after 5.3.2.0 that includes the vendor's XSS fix
• Audit WordPress user accounts for unauthorized administrator additions or role escalations
• Force password resets and invalidate active sessions for administrators who may have interacted with untrusted links

Patch Information

Metagauss addressed the vulnerability in a release subsequent to 5.3.2.0. Refer to the Patchstack XSS Vulnerability Advisory for vendor guidance and the fixed version. Apply the update through the WordPress plugin manager or via manual upload.

Workarounds

• Deploy a WAF rule to block requests containing script tags or JavaScript event handlers targeting RegistrationMagic endpoints
• Restrict access to RegistrationMagic administrative pages by IP allowlist until patching is complete
• Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on WordPress pages

# Example CSP header to reduce XSS impact in nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;