CVE-2024-35693 Overview
CVE-2024-35693 is a Cross-Site Scripting (XSS) vulnerability in the AA Web Servant 12 Step Meeting List plugin for WordPress. The flaw affects all plugin versions up to and including 3.14.33. Attackers can inject malicious scripts that execute in the browser context of users who interact with a crafted link or page.
The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction but no authentication, and it can lead to session compromise, credential theft, or delivery of secondary payloads on affected WordPress sites.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, potentially hijacking WordPress administrator sessions and pivoting to full site compromise.
Affected Products
- Code4recovery 12 Step Meeting List WordPress plugin (all versions through 3.14.33)
- WordPress sites running the vulnerable plugin
- Recovery community and meeting-directory websites deploying the plugin
Discovery Timeline
- 2024-06-08 - CVE-2024-35693 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35693
Vulnerability Analysis
The 12 Step Meeting List plugin fails to properly neutralize user-controlled input before it is reflected into web page output. This allows attackers to embed JavaScript payloads that render in the context of the vulnerable WordPress site.
Because the CVSS vector indicates a scope change and requires user interaction, the flaw fits a reflected or stored XSS pattern where a victim must load an attacker-crafted URL or plugin-rendered page. Successful exploitation runs script in the origin of the WordPress site, giving the attacker access to session cookies, DOM contents, and any privileged actions the victim can perform.
Additional technical details are documented in the Patchstack XSS Vulnerability Advisory.
Root Cause
The root cause is missing or insufficient output encoding on input handled by the plugin before it is written into HTML responses. Input passed through plugin request handlers is not escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses() prior to rendering, enabling script injection.
Attack Vector
An attacker crafts a URL or form submission containing a JavaScript payload targeting a vulnerable parameter in the plugin. The attacker then delivers the link through phishing, social engineering, or a public web channel. When an authenticated administrator or site visitor loads the URL, the payload executes in the browser under the site's origin, enabling cookie theft, forced admin actions, or defacement.
No verified public exploit code is available for CVE-2024-35693. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2024-35693
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or HTML event handlers in plugin-rendered pages or database records tied to meeting entries.
- Web server logs showing requests to 12 Step Meeting List plugin endpoints containing encoded angle brackets, onerror=, or onload= payloads.
- New or unexplained WordPress administrator accounts, altered plugin settings, or unexpected outbound requests from admin browsers.
Detection Strategies
- Inventory WordPress installations and identify sites running the 12 Step Meeting List plugin at version 3.14.33 or earlier.
- Inspect stored plugin data (meeting titles, descriptions, custom fields) for HTML or JavaScript content that should not be present.
- Deploy a web application firewall rule set that flags reflected XSS patterns targeting WordPress plugin request parameters.
Monitoring Recommendations
- Monitor WordPress wp-admin sessions for anomalous activity following visits to plugin-rendered pages.
- Alert on Content Security Policy (CSP) violations reported from pages generated by the plugin.
- Track plugin version drift across managed WordPress fleets and flag any host not upgraded past 3.14.33.
How to Mitigate CVE-2024-35693
Immediate Actions Required
- Update the 12 Step Meeting List plugin to the latest fixed version released after 3.14.33.
- Audit WordPress administrator accounts and rotate credentials and session cookies if suspicious activity is observed.
- Review stored meeting data for injected HTML or JavaScript and sanitize any tainted records.
Patch Information
The vendor has released a patched version of the plugin. Consult the Patchstack XSS Vulnerability Advisory for the fixed version number and apply the update through the WordPress plugin manager or WP-CLI.
Workarounds
- Temporarily deactivate the 12 Step Meeting List plugin until patching is complete.
- Enforce a strict Content Security Policy that blocks inline scripts on pages rendered by the plugin.
- Restrict access to WordPress administrative interfaces by IP allowlist to reduce exposure to reflected XSS delivered to administrators.
# Update the plugin using WP-CLI
wp plugin update 12-step-meeting-list
# Verify the installed version is above 3.14.33
wp plugin get 12-step-meeting-list --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.