CVE-2024-47384: WP Compress Image Optimizer XSS Vulnerability

CVE-2024-47384 Overview

CVE-2024-47384 is a reflected cross-site scripting (XSS) vulnerability in the AresIT WP Compress Image Optimizer plugin for WordPress. The flaw affects all versions of wp-compress-image-optimizer up to and including 6.20.13. Attackers can craft malicious URLs that inject JavaScript into responses rendered by the plugin. Successful exploitation requires user interaction, typically clicking a crafted link. The vulnerability is categorized under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
A remote attacker can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or unauthorized actions within the WordPress administrative context.

Affected Products

AresIT WP Compress Image Optimizer plugin for WordPress
Versions from n/a through 6.20.13
WordPress sites running the vulnerable plugin

Discovery Timeline

2024-10-05 - CVE-2024-47384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47384

Vulnerability Analysis

The WP Compress Image Optimizer plugin fails to properly sanitize or encode user-controlled input before reflecting it back in HTTP responses. This allows an attacker to embed JavaScript payloads in request parameters that the plugin renders directly into HTML output. When a victim visits a crafted URL, the browser executes the injected script in the origin context of the WordPress site.

Reflected XSS on a WordPress site can compromise authenticated administrators. An attacker who tricks an admin into visiting a malicious link can execute JavaScript with the admin's privileges, potentially installing plugins, creating users, or exfiltrating data.

Root Cause

The root cause is missing output encoding on data reflected from the HTTP request into the response body. The plugin does not apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() to input values before echoing them into generated pages. This behavior maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack requires no authentication but does require user interaction. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by the plugin. The attacker then delivers the URL through phishing, social media, or embedded links. When a target with an active WordPress session clicks the link, the payload executes in their browser. Because the vulnerability has a changed scope, the injected script can affect resources beyond the vulnerable component.

No public proof-of-concept exploit code is available. For technical specifics, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-47384

Indicators of Compromise

Unexpected HTTP requests containing script tags, javascript: URIs, or common XSS payloads (onerror=, onload=, <svg/onload>) targeting WP Compress plugin endpoints
Referrer logs showing external phishing domains directing users to WordPress admin URLs with encoded query strings
Unauthorized administrative actions (new users, plugin installations, option changes) shortly after admin sessions visit unusual URLs

Detection Strategies

Inspect web server access logs for query parameters targeting wp-compress-image-optimizer paths with suspicious characters such as <, >, ", or URL-encoded equivalents
Deploy a Web Application Firewall (WAF) with OWASP Core Rule Set to identify reflected XSS patterns in inbound requests
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on WordPress pages

Monitoring Recommendations

Correlate WordPress audit logs with edge access logs to identify admin session activity following clicks on external links
Monitor plugin inventory for outdated wp-compress-image-optimizer installations across managed WordPress environments
Track browser telemetry for anomalous script execution or DOM modifications on WordPress admin pages

How to Mitigate CVE-2024-47384

Immediate Actions Required

Update the WP Compress Image Optimizer plugin to a version later than 6.20.13 as soon as the vendor publishes a fixed release
Audit WordPress sites for the presence and version of wp-compress-image-optimizer and prioritize patching internet-facing instances
Force logout of active administrator sessions and rotate credentials if suspicious activity is observed

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor advisory information. Apply the vendor-supplied update through the WordPress plugin manager once available.

Workarounds

Disable and remove the WP Compress Image Optimizer plugin until a patched version is installed
Deploy a WAF rule to block requests containing script injection patterns targeting the plugin's endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources on WordPress sites
Require administrators to use dedicated browsers or profiles for WordPress management to limit session exposure

bash

# Example WAF ModSecurity rule to block reflected XSS payloads targeting the plugin
SecRule REQUEST_URI "@contains wp-compress-image-optimizer" \
  "chain,id:1004747,phase:2,deny,status:403,msg:'Potential XSS targeting WP Compress'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|<svg)" "t:urlDecodeUni,t:htmlEntityDecode"