CVE-2024-51699: Buooy Sticky Header XSS Vulnerability

CVE-2024-51699 Overview

CVE-2024-51699 is a reflected Cross-Site Scripting (XSS) vulnerability in the Buooy Sticky Header WordPress plugin. The flaw affects all plugin versions up to and including 0.5.2. It stems from improper neutralization of user-supplied input during web page generation [CWE-79].

Attackers can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The scope is changed, meaning injected scripts can affect resources beyond the vulnerable component. Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed under the victim's privileges.

Critical Impact
Reflected XSS in the Buooy Sticky Header plugin allows attackers to execute arbitrary JavaScript in the browser of any user who clicks a crafted link, leading to session hijacking and account compromise within WordPress sites.

Affected Products

Buooy Sticky Header WordPress plugin versions through 0.5.2
WordPress sites with the buooy-sticky-header plugin installed and active
All WordPress hosting environments running the vulnerable plugin

Discovery Timeline

2024-11-09 - CVE-2024-51699 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51699

Vulnerability Analysis

The Buooy Sticky Header plugin fails to properly sanitize and encode user-controlled input before reflecting it back in HTTP responses. This classic reflected XSS pattern allows attackers to inject HTML and JavaScript through URL parameters or request data that the plugin processes without adequate validation.

The vulnerability requires user interaction. An attacker must convince a target to click a specially crafted link or visit a malicious page that triggers the request. Once the victim's browser renders the response, the injected payload executes in the context of the WordPress site's origin.

The attack vector is network-based and requires no authentication. Because the CVSS scope is changed, injected scripts can pivot to affect components beyond the immediate plugin, including authenticated admin sessions if the victim holds elevated privileges.

Root Cause

The plugin code reflects user input into HTML output without applying output encoding functions such as WordPress's esc_html(), esc_attr(), or wp_kses(). Input that should be treated as data is instead interpreted as executable markup by the browser.

Attack Vector

An attacker constructs a URL containing a JavaScript payload in a vulnerable parameter handled by the plugin. The attacker distributes the link through phishing email, social media, or compromised sites. When the victim clicks the link, the WordPress site returns the unsanitized payload in its response, and the browser executes the script under the site's domain. The vulnerability mechanism is documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-51699

Indicators of Compromise

HTTP requests to WordPress endpoints containing URL-encoded <script> tags, javascript: schemes, or event handlers such as onerror= and onload=
Referer headers pointing to external phishing domains followed by requests to buooy-sticky-header plugin paths
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting WordPress admin pages

Detection Strategies

Inspect web server access logs for suspicious query parameters containing HTML or JavaScript syntax targeting the plugin
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns in GET and POST parameters
Monitor WordPress audit logs for anomalous administrator actions following link clicks, such as new admin user creation or plugin installation

Monitoring Recommendations

Enable verbose logging on WordPress and the upstream reverse proxy to capture full request URIs and headers
Alert on Content Security Policy (CSP) violation reports indicating blocked inline script execution
Track changes to WordPress user roles, options, and theme files for signs of post-exploitation activity

How to Mitigate CVE-2024-51699

Immediate Actions Required

Deactivate and remove the Buooy Sticky Header plugin until a patched version is confirmed available
Audit administrator accounts and reset credentials for users who may have clicked suspicious links
Review WordPress site files, scheduled tasks, and database options for unauthorized modifications

Patch Information

No fixed version has been published at the time of disclosure. The vulnerability affects all releases through 0.5.2. Site operators should monitor the Patchstack advisory for patch availability and apply updates immediately when released.

Workarounds

Remove the buooy-sticky-header plugin from the WordPress installation as the most effective mitigation
Deploy a WAF with managed rules that block reflected XSS payloads targeting WordPress plugins
Implement a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources
Train administrators to avoid clicking unsolicited links and to use separate browser profiles for WordPress administration

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate buooy-sticky-header
wp plugin delete buooy-sticky-header

# Example CSP header to mitigate XSS impact (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;