CVE-2024-50522: WeChat Subscribers Lite XSS Vulnerability

CVE-2024-50522 Overview

CVE-2024-50522 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the redyyu WeChat Subscribers Lite WordPress plugin (wechat-subscribers-lite). The flaw stems from improper neutralization of user-controlled input during web page generation. Attackers can craft malicious URLs that, when visited by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability affects all plugin versions up to and including 1.6.6. Exploitation requires user interaction but no authentication, and the impact crosses security scopes by leveraging the trusted WordPress origin.

Critical Impact

Successful exploitation allows attackers to execute arbitrary script in a victim's browser, leading to session hijacking, credential theft, or administrative action abuse within the WordPress site.

Affected Products

• WeChat Subscribers Lite plugin for WordPress, versions through 1.6.6
• WordPress sites using the wechat-subscribers-lite plugin by redyyu
• All deployments that have not applied a patched release

Discovery Timeline

• 2024-11-19 - CVE-2024-50522 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-50522

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the wechat-subscribers-lite WordPress plugin. The plugin echoes user-supplied request parameters into rendered HTML responses without proper sanitization or output encoding. An attacker delivers a crafted URL containing a JavaScript payload via phishing, social engineering, or a malicious link. When a target loads the URL in an authenticated session, the payload executes in the browser under the WordPress site's origin.

Because the scope changes during exploitation, the injected script can access cookies, manipulate the Document Object Model (DOM), and issue authenticated requests on behalf of the victim. Administrative users represent the highest-value targets because their sessions can be abused to install plugins, modify content, or create new accounts. The exploit prediction (EPSS) probability for this CVE is 0.197% at the 41.487 percentile.

Root Cause

The root cause is missing input neutralization on request parameters consumed by plugin endpoints. The plugin fails to apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() before reflecting parameter values into the HTML response. This omission allows raw <script> tags or event-handler attributes to be rendered verbatim.

Attack Vector

The attack is network-based and reflected. An attacker constructs a URL targeting a vulnerable plugin endpoint and embeds a JavaScript payload in a query string parameter. The victim must click the link or be redirected to it while authenticated to the WordPress site. The server reflects the payload into the response, the browser parses it, and the script executes. Refer to the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-50522

Indicators of Compromise

• HTTP requests to wechat-subscribers-lite plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in query parameters.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting plugin pages.
• New WordPress administrator accounts or modified user roles without a corresponding audit trail.

Detection Strategies

• Inspect web server access logs for suspicious query string patterns referencing the wechat-subscribers-lite plugin path.
• Deploy a Web Application Firewall (WAF) rule set with OWASP Core Rule Set signatures for reflected XSS payloads.
• Use browser-side Content Security Policy (CSP) violation reports to identify inline script execution attempts.

Monitoring Recommendations

• Alert on HTTP GET and POST requests to plugin URIs containing HTML or JavaScript metacharacters such as <, >, ", or %3C.
• Monitor WordPress audit logs for privilege changes, plugin installations, and option modifications by administrator accounts.
• Track referrer headers on plugin requests to identify off-site redirection patterns consistent with phishing delivery.

How to Mitigate CVE-2024-50522

Immediate Actions Required

• Identify all WordPress sites running wechat-subscribers-lite version 1.6.6 or earlier and prioritize remediation on administrator-facing deployments.
• Deactivate and remove the plugin if a fixed version is not available and the functionality is not business critical.
• Force a password reset and invalidate active sessions for administrative accounts that may have visited crafted links.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest fix status and upgrade guidance. If a release beyond 1.6.6 becomes available, update immediately through the WordPress plugin manager.

Workarounds

• Restrict access to the WordPress administration interface using IP allowlists or VPN-only access policies.
• Deploy a WAF with virtual patching rules that block reflected XSS payloads targeting the wechat-subscribers-lite endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
• Train administrators to avoid clicking unsolicited links that reference their own WordPress site with unusual query parameters.

# Example WAF rule to block reflected XSS patterns on the affected plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/wechat-subscribers-lite/" \
  "chain,phase:2,deny,status:403,id:1005220,msg:'Block XSS attempt on wechat-subscribers-lite'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:lowercase"