CVE-2024-37245: Vsourz All In One Redirection XSS Vulnerability

CVE-2024-37245 Overview

CVE-2024-37245 is a reflected cross-site scripting (XSS) vulnerability in the Vsourz Digital All In One Redirection plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. It affects all plugin versions up to and including 2.2.0. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser session when the victim clicks the link. The vulnerability requires user interaction but no authentication, expanding the pool of potential targets. Because the plugin is deployed on WordPress sites, exploitation can lead to session theft, credential harvesting, or administrative account takeover when a logged-in administrator triggers the payload.

Critical Impact
Reflected XSS enables attackers to execute arbitrary JavaScript in victim browsers, potentially hijacking WordPress administrator sessions and pivoting to full site compromise.

Affected Products

Vsourz Digital All In One Redirection WordPress plugin versions up to 2.2.0
WordPress sites running the plugin without vendor mitigation
Administrator and editor accounts interacting with attacker-supplied links

Discovery Timeline

2024-07-22 - CVE-2024-37245 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37245

Vulnerability Analysis

The All In One Redirection plugin fails to sanitize or encode user-controlled input before reflecting it into HTML responses. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by the plugin. When a victim clicks the link, the server reflects the payload into the rendered page, and the browser executes it in the site's origin.

Because the scope is changed (S:C in the CVSS vector), the injected script can affect resources beyond the vulnerable component itself, including WordPress administrative interfaces sharing the same origin. Successful exploitation can steal authentication cookies, perform actions on behalf of authenticated users, or inject persistent redirects and malicious content.

Root Cause

The root cause is missing output encoding and input validation on parameters used by the plugin's redirection handling logic. The plugin echoes attacker-controlled data directly into HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). Without contextual escaping, browsers interpret injected <script> tags and event handlers as executable code rather than data.

Attack Vector

Exploitation occurs over the network and requires the victim to click a crafted link or visit an attacker-controlled page that triggers the request. Typical delivery methods include phishing emails, malicious advertisements, or links posted in comments and forums. When a WordPress administrator is the victim, the attacker can leverage the executed script to modify redirection rules, install malicious plugins, or create rogue administrator accounts. See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-37245

Indicators of Compromise

Web server access logs containing request parameters with <script>, javascript:, onerror=, or URL-encoded equivalents targeting plugin endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains following a click on an inbound link
New or modified redirection rules within the All In One Redirection plugin configuration that were not created by authorized users

Detection Strategies

Inspect WordPress access logs for query strings referencing the All In One Redirection plugin with suspicious HTML or script fragments
Deploy a web application firewall rule set that flags reflected XSS payload patterns targeting known plugin parameters
Correlate referer headers pointing to external domains with subsequent administrative actions inside WordPress

Monitoring Recommendations

Enable WordPress audit logging to record plugin configuration changes, user creation events, and role modifications
Monitor for unexpected wp-admin sessions originating from unusual geolocations or user agents
Alert on newly registered administrator accounts and changes to active plugins or themes

How to Mitigate CVE-2024-37245

Immediate Actions Required

Update the All In One Redirection plugin to a version later than 2.2.0 once the vendor publishes a fix, or deactivate and remove the plugin if no patch is available
Force password resets for all WordPress administrator and editor accounts that may have clicked untrusted links
Review the plugin's redirection rules for unauthorized modifications and revert any suspicious entries

Patch Information

At the time of publication, the Patchstack XSS Vulnerability Advisory lists all versions through 2.2.0 as affected. Administrators should monitor the WordPress plugin repository for a fixed release and apply it immediately upon availability.

Workarounds

Deactivate the All In One Redirection plugin until a patched version is released
Deploy a web application firewall rule that blocks requests containing script tags or JavaScript URI schemes in plugin parameters
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins

bash

# Example Content Security Policy header for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';" always;