CVE-2024-35664: WPvivid Backup for MainWP XSS Vulnerability

CVE-2024-35664 Overview

CVE-2024-35664 is a reflected Cross-Site Scripting (XSS) vulnerability in the WPvivid Backup for MainWP WordPress plugin developed by wpvividplugins. The flaw stems from Improper Neutralization of Input During Web Page Generation [CWE-79] and affects all plugin versions up to and including 0.9.32. Attackers can craft malicious URLs that, when visited by an authenticated administrator, execute arbitrary JavaScript in the victim's browser session. Successful exploitation can lead to session hijacking, credential theft, or unauthorized administrative actions on the WordPress MainWP dashboard.

Critical Impact
Reflected XSS in a MainWP backup management plugin allows attackers to execute JavaScript in administrator sessions, potentially compromising centrally managed WordPress sites.

Affected Products

WPvivid Backup for MainWP plugin versions through 0.9.32
WordPress sites running the MainWP dashboard with WPvivid Backup integration
Multi-site WordPress environments managed via MainWP that rely on this plugin for centralized backups

Discovery Timeline

2024-06-04 - CVE CVE-2024-35664 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35664

Vulnerability Analysis

The vulnerability is a reflected XSS flaw [CWE-79] in the WPvivid Backup for MainWP plugin. The plugin reflects user-supplied input back into HTML responses without proper encoding or sanitization. An attacker crafts a URL containing JavaScript payloads inside a vulnerable request parameter. When an authenticated MainWP administrator clicks the link, the server echoes the malicious payload into the page, and the browser executes it in the context of the administrator session.

Because MainWP consoles manage multiple downstream WordPress sites, code execution in an administrator session can cascade into broader compromise of child sites, including backup manipulation and credential theft.

Root Cause

The root cause is missing output encoding and inadequate input validation on request parameters handled by the plugin. User-controlled data is written directly into the rendered HTML response without escaping functions such as esc_html(), esc_attr(), or wp_kses(). The scope change in the CVSS vector (S:C) reflects that script executes beyond the vulnerable component, impacting the broader WordPress administrative context.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted URL containing an XSS payload through phishing, social engineering, or malicious links embedded in third-party content. The victim must be an authenticated MainWP administrator for maximum impact. No prior authentication or privileges are required for the attacker to craft the payload. See the Patchstack advisory for technical details.

No verified public proof-of-concept code is referenced in the advisory data. The vulnerability pattern follows standard reflected XSS behavior: an attacker-controlled parameter is reflected unsanitized into the HTTP response and executed by the browser.

Detection Methods for CVE-2024-35664

Indicators of Compromise

Suspicious HTTP GET or POST requests to WPvivid Backup for MainWP endpoints containing script tags, javascript: URIs, or encoded payloads such as %3Cscript%3E.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following access to crafted URLs.
Unauthorized administrative actions in MainWP logs that correlate with administrator sessions clicking external links.

Detection Strategies

Inspect web server access logs for requests to WPvivid Backup for MainWP paths containing HTML or JavaScript metacharacters in query parameters.
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns targeting WordPress plugin endpoints.
Review MainWP activity logs for anomalous backup, restore, or user management actions occurring shortly after administrator link clicks.

Monitoring Recommendations

Enable WordPress audit logging for the MainWP dashboard and forward events to a centralized SIEM for correlation.
Monitor administrator browser telemetry for unexpected script execution or outbound beacons from WordPress admin pages.
Alert on new or modified administrative accounts, API keys, or scheduled backup jobs in MainWP.

How to Mitigate CVE-2024-35664

Immediate Actions Required

Upgrade WPvivid Backup for MainWP to a version later than 0.9.32 once the vendor publishes a patched release.
Instruct MainWP administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard.
Audit MainWP activity logs for suspicious actions dating back to the plugin installation.

Patch Information

The vulnerability affects WPvivid Backup for MainWP through version 0.9.32. Monitor the vendor's plugin page and the Patchstack vulnerability database for patch availability. Apply the fixed version through the WordPress plugin update workflow as soon as it is released.

Workarounds

Deactivate the WPvivid Backup for MainWP plugin until a patched version is available if active exploitation is suspected.
Restrict access to the WordPress admin interface by IP allowlist at the web server or WAF layer.
Enforce a strict Content Security Policy (CSP) on the WordPress admin pages to limit inline script execution.
Require administrators to use isolated browser profiles with no stored credentials for the MainWP dashboard.

bash

# Example nginx configuration to add a restrictive CSP header on wp-admin
location ^~ /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}