CVE-2024-37199: Kriesi Enfold XSS Vulnerability

CVE-2024-37199 Overview

CVE-2024-37199 is a reflected Cross-Site Scripting (XSS) vulnerability in the Kriesi Enfold WordPress theme. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. It affects all Enfold versions up to and including 5.6.9. An unauthenticated attacker can craft a malicious URL that, when visited by a target, executes arbitrary JavaScript in the victim's browser context. Successful exploitation can lead to session hijacking, credential theft, or unauthorized administrative actions if a logged-in administrator is targeted.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by tricking users into clicking a crafted link, potentially compromising WordPress administrator accounts.

Affected Products

Kriesi Enfold WordPress theme versions through 5.6.9
WordPress sites using vulnerable Enfold theme installations
Any web application deploying Enfold as its front-end theme

Discovery Timeline

2024-07-22 - CVE-2024-37199 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37199

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Enfold theme's request handling. Enfold fails to properly sanitize or encode user-controlled input before including it in HTTP response content. When a crafted request reaches a vulnerable endpoint, the injected payload is reflected back into the rendered page and executed by the browser.

Exploitation requires user interaction. An attacker must convince a victim to click a malicious link or visit an attacker-controlled page that issues the request. The attack occurs over the network without authentication. Because the vulnerability scope is changed, injected scripts can affect resources beyond the vulnerable component, including the WordPress administrative interface.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Input parameters accepted by Enfold are echoed into HTML output without contextual output encoding or input filtering. This allows HTML and JavaScript control characters to break out of their intended data context and execute as code.

Attack Vector

The attack vector is network-based and requires victim interaction. An attacker constructs a URL containing a JavaScript payload in a vulnerable parameter processed by the Enfold theme. When a victim, particularly an authenticated WordPress user, follows the link, the payload executes with the privileges of that user's session. Typical outcomes include cookie theft, session token exfiltration, forced administrative actions via forged requests, and credential harvesting through injected form overlays.

No public proof-of-concept exploit or exploit database entry is currently listed for this issue. Refer to the Patchstack advisory for Enfold XSS for technical details.

Detection Methods for CVE-2024-37199

Indicators of Compromise

HTTP requests to Enfold theme endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= payloads in query parameters
Unexpected outbound requests from browser sessions to attacker-controlled domains immediately after loading Enfold-rendered pages
WordPress admin account activity originating from unfamiliar IP addresses or user agents shortly after an admin clicked an external link
Log entries showing referrers from phishing domains directing users to WordPress pages served by Enfold

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects query strings for reflected XSS patterns against WordPress theme paths
Monitor WordPress access logs for suspicious query parameters containing HTML tags, event handlers, or encoded script markers
Correlate authentication events with recent HTTP requests to identify session anomalies following possible XSS delivery

Monitoring Recommendations

Enable verbose logging on the reverse proxy or WordPress access log to capture full request URIs including query strings
Alert on repeated 200 OK responses to requests carrying script-like parameter values on Enfold theme routes
Track administrative actions such as user creation, plugin installation, and role changes for out-of-band activity

How to Mitigate CVE-2024-37199

Immediate Actions Required

Update the Enfold theme to a version later than 5.6.9 as soon as the vendor releases a fixed build
Restrict WordPress administrator access to trusted networks and require multi-factor authentication for privileged accounts
Instruct administrators and editors to avoid clicking untrusted links while authenticated to the WordPress dashboard
Deploy a WAF with reflected XSS signatures in front of any WordPress site running Enfold

Patch Information

The issue affects Enfold versions up to and including 5.6.9. Consult the Patchstack advisory and the Kriesi vendor portal for the latest patched release. Apply the upgrade to all WordPress installations that use the Enfold theme.

Workarounds

Configure a strict Content-Security-Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins
Set HttpOnly and Secure flags on WordPress session cookies to reduce the impact of client-side script execution
Temporarily switch to an alternative theme on sensitive sites until a patched version of Enfold is installed

bash

# Example nginx Content-Security-Policy header for WordPress
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;