CVE-2024-39663: WP Fast Total Search XSS Vulnerability

CVE-2024-39663 Overview

CVE-2024-39663 is a Cross-Site Scripting (XSS) vulnerability affecting the Epsiloncool WP Fast Total Search WordPress plugin (fulltext-search). The flaw stems from improper neutralization of input during web page generation [CWE-79]. All plugin versions up to and including 1.68.232 are affected. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes attacker-controlled JavaScript in the victim's browser session. The vulnerability has a changed scope, meaning injected script can impact resources beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser context, enabling session hijacking, credential theft, and unauthorized actions against the WordPress site.

Affected Products

Epsiloncool WP Fast Total Search (fulltext-search) plugin for WordPress
All versions from initial release through 1.68.232
WordPress sites with the affected plugin installed and active

Discovery Timeline

2024-08-01 - CVE-2024-39663 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39663

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the WP Fast Total Search plugin. The plugin fails to properly sanitize and encode user-supplied input before reflecting it back into rendered HTML output. Attackers can inject JavaScript payloads through unsanitized request parameters handled by the plugin's search functionality.

Exploitation requires user interaction, typically by tricking an authenticated administrator or visitor into clicking a crafted URL. The changed scope indicates the injected script can affect other components beyond the plugin itself, including the broader WordPress administrative interface and authenticated user sessions. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Root Cause

The root cause is the absence of proper output encoding and input sanitization on data passed through the plugin's search request handlers. User-controlled values are concatenated into HTML responses without escaping characters such as <, >, and quotation marks, allowing attackers to break out of the intended HTML context and inject <script> tags or event handlers.

Attack Vector

The attack is network-based and requires no authentication. An attacker crafts a URL containing a malicious payload in a vulnerable query parameter consumed by the plugin. The attacker delivers this URL through phishing, forum posts, or third-party sites. When a victim clicks the link, the plugin reflects the payload into the response page and the browser executes the injected script under the origin of the vulnerable WordPress site.

No verified exploit code is publicly available. The vulnerability mechanism is described in the linked Patchstack advisory.

Detection Methods for CVE-2024-39663

Indicators of Compromise

Web server access logs containing search request parameters with encoded <script>, onerror=, onload=, or javascript: payloads targeting plugin endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains following access to search pages
New or modified WordPress administrative accounts created shortly after suspicious search URL access
HTTP referers pointing to external sites with crafted query strings targeting the fulltext-search plugin

Detection Strategies

Inspect web server and WAF logs for requests to plugin endpoints containing HTML special characters or known XSS payload patterns
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts
Correlate clicks on external links with subsequent administrative actions in WordPress audit logs

Monitoring Recommendations

Enable WordPress activity logging plugins to track authenticated session changes and privilege modifications
Monitor for the presence of WP Fast Total Search plugin versions at or below 1.68.232 across managed WordPress installations
Alert on browser-side anomalies such as unexpected redirects or script execution from WordPress administrative pages

How to Mitigate CVE-2024-39663

Immediate Actions Required

Update the WP Fast Total Search plugin to a version newer than 1.68.232 once the vendor publishes a fixed release
Deactivate and remove the plugin if a patched version is not available and the functionality is non-essential
Review WordPress administrator accounts for unauthorized changes and rotate credentials for any account that may have clicked suspicious links

Patch Information

Consult the Patchstack advisory for the latest information on patched versions. Apply updates through the WordPress plugin management interface or by replacing plugin files directly on the server.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking requests to the plugin's search endpoints that contain HTML tags or JavaScript event handlers in parameters
Implement a strict Content Security Policy that disallows inline scripts and unknown external script sources
Restrict access to the WordPress administrative interface by IP address or VPN until a patched plugin version is deployed

bash

# Example WAF rule pattern (ModSecurity) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1003963,phase:2,deny,status:403,msg:'CVE-2024-39663 XSS payload blocked'"