CVE-2024-47297: CP Polls WordPress Plugin XSS Vulnerability

CVE-2024-47297 Overview

CVE-2024-47297 is a reflected cross-site scripting (XSS) vulnerability in the codepeople CP Polls plugin for WordPress. The flaw affects all versions of cp-polls up to and including 1.0.74. The plugin fails to properly neutralize user-supplied input before reflecting it back in generated web pages. An unauthenticated attacker can craft a malicious link that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's browser session, enabling session hijacking, credential theft, and unauthorized actions on the affected WordPress site.

Affected Products

• codepeople CP Polls (cp-polls) WordPress plugin versions through 1.0.74
• WordPress sites running the vulnerable plugin
• Site administrators and authenticated users targeted by crafted links

Discovery Timeline

• 2024-10-06 - CVE-2024-47297 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-47297

Vulnerability Analysis

The CP Polls plugin processes user-supplied parameters and reflects them back in HTTP responses without adequate output encoding or sanitization. When a victim visits a crafted URL containing malicious payload, the unsanitized input is rendered as part of the HTML response. The browser then interprets the injected script as legitimate page content and executes it in the site's origin context.

Reflected XSS in WordPress plugins is particularly impactful because the script runs with the privileges of the authenticated user who clicked the link. If an administrator triggers the payload, the attacker can perform actions such as creating new admin accounts, modifying plugin settings, or injecting persistent backdoors via the WordPress REST API.

Root Cause

The root cause is missing or insufficient input validation and output escaping in the plugin's request handlers. The plugin does not apply WordPress core sanitization functions such as esc_html(), esc_attr(), or sanitize_text_field() to user-controlled data before echoing it into the response.

Attack Vector

The attack requires user interaction (UI:R) over the network. An attacker delivers a crafted URL via phishing email, social media, or a third-party site. When the victim clicks the link while authenticated to the WordPress site, the payload executes in their browser. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the user's browser session.

For technical details, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-47297

Indicators of Compromise

• HTTP requests to CP Polls plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: patterns in query parameters
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
• Creation of new WordPress administrator accounts or unexpected plugin/theme installations following suspicious link clicks
• Modified WordPress options or unfamiliar scheduled tasks (wp_cron) entries

Detection Strategies

• Inspect web server access logs for requests to cp-polls plugin paths containing reflected XSS payload signatures
• Deploy a web application firewall (WAF) rule set that flags reflected XSS patterns targeting WordPress plugin parameters
• Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution attempts

Monitoring Recommendations

• Enable detailed HTTP request logging on the WordPress site and forward logs to a centralized analytics platform
• Track changes to WordPress user roles, plugin files, and wp_options table entries
• Alert on outbound network connections from authenticated admin sessions to newly registered or low-reputation domains

How to Mitigate CVE-2024-47297

Immediate Actions Required

• Update the CP Polls plugin to a version later than 1.0.74 as soon as a patched release is available from codepeople
• Deactivate and remove the cp-polls plugin if no patched version is available and the functionality is not business-critical
• Audit WordPress administrator accounts and recent site changes for signs of post-exploitation activity
• Force password resets for all administrative users and invalidate active sessions

Patch Information

Review the Patchstack Vulnerability Report for the latest patch status. Apply vendor-supplied updates through the WordPress plugin manager once available.

Workarounds

• Deploy a WAF rule to block requests containing common XSS payloads targeting CP Polls endpoints
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Restrict administrator access to the WordPress dashboard via IP allowlisting until a patch is applied
• Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin panel

# Example WAF rule (ModSecurity) to block reflected XSS payloads on cp-polls endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/cp-polls/" \
    "chain,phase:2,deny,status:403,id:1004729701,msg:'CVE-2024-47297 XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni"