CVE-2024-47379: Web Directory Free XSS Vulnerability

CVE-2024-47379 Overview

CVE-2024-47379 is a reflected Cross-Site Scripting (XSS) vulnerability in the Shamalli Web Directory Free plugin for WordPress. The flaw affects all versions of web-directory-free up to and including 1.7.3. It is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

An attacker can craft a malicious URL containing JavaScript payloads. When a victim clicks the link, the plugin reflects the unsanitized input back into the rendered page. The injected script then executes in the victim's browser under the site's origin.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated user's browser, enabling session theft, credential harvesting, and actions performed on behalf of administrators.

Affected Products

Shamalli Web Directory Free (web-directory-free) WordPress plugin
All versions from n/a through 1.7.3
WordPress installations running the vulnerable plugin

Discovery Timeline

2024-10-05 - CVE-2024-47379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47379

Vulnerability Analysis

The vulnerability is a reflected XSS issue affecting the web-directory-free WordPress plugin. The plugin accepts user-controlled input via HTTP request parameters and includes that input in the generated HTML response without proper output encoding or sanitization.

Because the payload is reflected in the same request-response cycle, exploitation requires the victim to visit an attacker-crafted URL. The CVSS vector indicates user interaction is required and that the scope changes, meaning the injected script can affect resources beyond the vulnerable component.

The EPSS score of 0.292% places the likelihood of exploitation in the 20th percentile, but publicly documented WordPress XSS flaws are frequently weaponized against unpatched sites.

Root Cause

The root cause is the failure to neutralize special HTML and JavaScript characters in user-supplied input before writing that data into a web page. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to relevant request parameters. As a result, characters like <, >, and " pass through into the response body unmodified.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL pointing to a vulnerable endpoint of the web-directory-free plugin. The URL includes a query parameter containing a JavaScript payload such as a <script> tag or an event handler attribute.

The attacker then distributes the link through phishing emails, social media, or malicious advertising. When an authenticated WordPress user, particularly an administrator, clicks the link, the payload executes in their browser session. The attacker can then hijack the session cookie, submit administrative forms via CSRF, or redirect the victim to attacker-controlled infrastructure.

For technical details on the specific injection points, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-47379

Indicators of Compromise

HTTP requests to web-directory-free plugin endpoints containing URL-encoded <script>, javascript:, or onerror= strings in query parameters
Web server access logs showing referrers from external phishing domains followed by requests to the plugin's public URLs
Unusual outbound requests from administrator browsers to unknown domains shortly after clicking directory links
Newly created administrator accounts or modified plugin/theme files following administrator interaction with directory pages

Detection Strategies

Inspect web server and Web Application Firewall (WAF) logs for reflected XSS patterns targeting plugin parameters
Monitor WordPress audit logs for unexpected administrative actions occurring immediately after page views on directory URLs
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts
Correlate browser-side script execution events with endpoint telemetry to identify session hijacking follow-on activity

Monitoring Recommendations

Enable and centrally collect WordPress access logs, focusing on requests containing HTML metacharacters in query strings
Alert on outbound HTTP requests from administrator workstations to newly registered or low-reputation domains
Track plugin file integrity and unexpected changes to wp_options, wp_users, and wp_usermeta tables
Baseline normal parameter values for the plugin and alert on anomalous lengths or character sets

How to Mitigate CVE-2024-47379

Immediate Actions Required

Update the Shamalli Web Directory Free plugin to a version later than 1.7.3 as soon as a fixed release is available from the vendor
If no patched version exists, deactivate and remove the web-directory-free plugin until a fix is released
Force logout of all active WordPress sessions and rotate administrator passwords and application secrets
Review recent administrator activity for signs of unauthorized configuration or content changes

Patch Information

At the time of NVD publication, the vulnerability affects all versions through 1.7.3 with no fixed version specified in the advisory. Administrators should consult the Patchstack Vulnerability Report for the latest patch status and vendor updates.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests containing script tags, event handlers, or javascript: URIs in parameters directed at the plugin
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to WordPress admin pages by IP allowlist to reduce the pool of high-value targets
Educate administrators to avoid clicking untrusted links while authenticated to WordPress

bash

# Example WAF rule (ModSecurity) to block common XSS payloads targeting the plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/web-directory-free/" \
    "chain,deny,status:403,id:1004779,msg:'Potential XSS targeting web-directory-free (CVE-2024-47379)'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"