CVE-2024-51647: Featured Posts Scroll CSRF Vulnerability

CVE-2024-51647 Overview

CVE-2024-51647 is a Cross-Site Request Forgery (CSRF) vulnerability in the Chaser324 Featured Posts Scroll plugin for WordPress. The flaw allows an attacker to chain a CSRF attack into Stored Cross-Site Scripting (XSS), persisting malicious JavaScript in the affected site. The issue affects Featured Posts Scroll versions up to and including 1.25. Exploitation requires that an authenticated administrator be tricked into clicking a crafted link or visiting an attacker-controlled page while logged in. Successful exploitation enables script execution in the browsers of subsequent site visitors, including privileged users. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
A successful CSRF-to-Stored-XSS chain allows an attacker to inject persistent JavaScript into a WordPress site, leading to session theft, administrative account takeover, and further compromise of site visitors.

Affected Products

Chaser324 Featured Posts Scroll WordPress plugin — versions up to and including 1.25
WordPress sites with the vulnerable plugin installed and active
Site administrators authenticated to vulnerable installations

Discovery Timeline

2024-11-09 - CVE-2024-51647 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-51647

Vulnerability Analysis

The Featured Posts Scroll plugin exposes administrative actions that modify plugin configuration without adequate request origin verification. The plugin fails to validate WordPress nonces or other anti-CSRF tokens on state-changing endpoints. This omission allows an attacker to forge requests that an authenticated administrator's browser will submit automatically.

The second-stage impact is Stored XSS. The plugin accepts attacker-controlled input through the forged request and persists it without proper output encoding or input sanitization. When the affected page renders, the injected payload executes in the browser of every viewer. This combination converts a single tricked click into persistent script execution affecting all subsequent users.

User interaction is required, but the attack scope is changed because the resulting XSS executes under the site's origin and can affect any visitor, including other administrators.

Root Cause

The root cause is a missing or improperly implemented CSRF protection mechanism on plugin configuration handlers, combined with insufficient sanitization of stored input. WordPress provides wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() for CSRF protection, alongside sanitize_text_field() and wp_kses() for output filtering. The vulnerable code paths in versions through 1.25 do not enforce these controls consistently.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing a hidden form or JavaScript that targets the vulnerable plugin endpoint on the victim site. When an authenticated WordPress administrator visits the attacker's page, their browser submits the forged request using the active session cookie. The plugin processes the request as legitimate, storing the attacker's JavaScript payload. Visitors to affected plugin output pages then execute the stored script.

No authenticated code example is published. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-51647

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes appearing in Featured Posts Scroll plugin configuration values stored in the WordPress database
Outbound requests from visitor browsers to unfamiliar domains when loading pages that render the plugin's output
Administrator session activity originating from unfamiliar IP addresses immediately following plugin configuration changes
New or modified administrator accounts created shortly after plugin settings were updated

Detection Strategies

Audit the wp_options table for plugin settings containing HTML or JavaScript markup that should be plain text
Review WordPress access logs for POST requests to plugin admin endpoints lacking a valid Referer header from the same origin
Inspect rendered front-end pages for injected <script> tags or event handlers that do not belong to the site's theme or trusted plugins

Monitoring Recommendations

Enable a web application firewall (WAF) rule set that blocks requests to WordPress admin endpoints missing valid nonces
Monitor file integrity and database content for changes to plugin-managed options
Alert on administrator-initiated configuration changes that occur outside business hours or from new geolocations

How to Mitigate CVE-2024-51647

Immediate Actions Required

Deactivate the Featured Posts Scroll plugin until a patched version is confirmed available and installed
Review and sanitize all plugin configuration values currently stored in the database, removing any HTML or JavaScript content
Rotate WordPress administrator passwords and invalidate active sessions if the plugin has been in use
Audit recent administrator activity for unauthorized configuration changes or account creation

Patch Information

At the time of publication, no fixed version beyond 1.25 is documented in the available advisory. Site operators should consult the Patchstack Vulnerability Report for the latest remediation guidance and check the plugin's WordPress.org listing for updates.

Workarounds

Uninstall the Featured Posts Scroll plugin and replace it with an actively maintained alternative
Deploy a WAF rule that enforces Referer and Origin header validation on wp-admin POST requests
Restrict WordPress administrator access to known IP ranges using server-level controls or .htaccess rules
Implement a Content Security Policy (CSP) header that disallows inline scripts to limit the impact of stored XSS

bash

# Example: restrict wp-admin access by IP via .htaccess
<Files wp-login.php>
  Require ip 203.0.113.0/24
</Files>

<Directory /var/www/html/wp-admin>
  Require ip 203.0.113.0/24
</Directory>

# Example: add a Content-Security-Policy header in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"