CVE-2024-3773 Overview
CVE-2024-3773 is a stored Cross-Site Scripting (XSS) vulnerability in the LiveJournal Shortcode WordPress plugin through version 1.1.1. The plugin fails to validate and escape certain shortcode attributes before rendering them in pages or posts. Authenticated users with the contributor role or higher can inject arbitrary JavaScript that executes in the browsers of site visitors and administrators. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation.
Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute against every visitor who loads the affected content, enabling session theft, administrative account takeover, and content defacement.
Affected Products
- LiveJournal Shortcode WordPress plugin, all versions through 1.1.1
- WordPress sites permitting contributor or higher role registrations that use the plugin
- WordPress installations where the plugin's shortcode is embedded in published content
Discovery Timeline
- 2026-09-02 - CVE-2024-3773 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2024-3773
Vulnerability Analysis
The LiveJournal Shortcode plugin registers a WordPress shortcode that accepts attributes supplied by post authors. When the shortcode is processed, the plugin outputs those attributes back into the rendered HTML without applying escaping functions such as esc_attr() or esc_html(). An attacker with contributor privileges can craft a shortcode whose attribute values contain HTML or JavaScript. When an editor previews, an administrator reviews, or a visitor loads the page, the injected script executes in the victim's browser context.
Because WordPress contributors can create posts but cannot publish them directly, exploitation typically targets reviewers who approve submissions. The scope-changed impact reflects that injected script executes in the administrator's authenticated session, crossing a trust boundary from the contributor's limited role.
Root Cause
The plugin's shortcode handler concatenates user-supplied attribute strings into the output markup without sanitization. WordPress provides escaping helpers for exactly this scenario, but the plugin's code path bypasses them. The result is direct reflection of attacker-controlled data into the DOM as executable content.
Attack Vector
An authenticated contributor authors a draft post containing the LiveJournal shortcode. The attacker sets one or more shortcode attributes to a payload containing HTML tag breakouts and JavaScript. When a higher-privileged user previews or publishes the draft, the browser parses the injected markup and executes the script under the site's origin. The payload can then perform actions as the reviewer, including creating administrator accounts, exfiltrating nonces, or modifying plugin settings. See the WPScan Vulnerability Advisory for technical details.
Detection Methods for CVE-2024-3773
Indicators of Compromise
- Post or page content containing LiveJournal shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: tokens
- Unexpected creation of administrator accounts or modification of user roles following contributor post submissions
- Outbound requests from administrator browsers to unfamiliar domains shortly after previewing contributor content
Detection Strategies
- Audit the wp_posts table for shortcode invocations containing suspicious characters such as <, ", or > inside attribute values
- Monitor WordPress audit logs for content edits by contributor-role accounts that reference the LiveJournal shortcode
- Deploy web application firewall rules that inspect POST bodies to wp-admin/post.php for XSS patterns within shortcode attributes
Monitoring Recommendations
- Review the plugin roster on all WordPress sites for LiveJournal Shortcode installations at version 1.1.1 or earlier
- Alert on new user registrations with elevated roles following recent contributor activity
- Enable Content Security Policy reporting to capture inline script violations rendered from stored content
How to Mitigate CVE-2024-3773
Immediate Actions Required
- Deactivate the LiveJournal Shortcode plugin until a patched release is available from the maintainer
- Restrict contributor and author role assignments to trusted users only
- Scan existing posts and drafts for the plugin's shortcode and remove any entries with suspicious attribute values
Patch Information
No vendor patch is referenced in the CVE record at the time of publication. The vulnerability affects all versions through 1.1.1. Consult the WPScan Vulnerability Advisory for updates on remediated releases.
Workarounds
- Remove the plugin and replace LiveJournal embeds with static HTML curated by trusted editors
- Enforce a strict Content Security Policy that disallows inline script execution on WordPress-rendered pages
- Require editor-level review of all contributor submissions in a sandboxed browser profile that is not logged into the administrative dashboard
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate livejournal-shortcode
wp plugin delete livejournal-shortcode
# Search post content for the shortcode across the database
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[livejournal%'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
