CVE-2024-51704: imPress wp-js-impress XSS Vulnerability

CVE-2024-51704 Overview

CVE-2024-51704 is a reflected cross-site scripting (XSS) vulnerability in the John Hanusek imPress WordPress plugin (wp-js-impress). The flaw affects all versions up to and including 0.1.4 and is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Attackers can craft a malicious URL that, when clicked by an authenticated or anonymous user, executes attacker-controlled JavaScript in the victim's browser session. The vulnerability requires user interaction and can affect the security scope beyond the vulnerable component, enabling session hijacking, credential theft, and site defacement.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, leading to session theft, administrative account takeover, and unauthorized actions on the WordPress site.

Affected Products

John Hanusek imPress (wp-js-impress) WordPress plugin
All versions from n/a through 0.1.4
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2024-11-09 - CVE CVE-2024-51704 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51704

Vulnerability Analysis

The imPress plugin fails to properly sanitize and encode user-supplied input before reflecting it back into HTTP responses. When a victim visits a crafted URL containing malicious payload data, the plugin renders the attacker's input directly into the generated HTML without applying context-appropriate output encoding. The browser then interprets the injected content as executable script.

This is a client-side execution issue with server-side origin. The malicious script runs in the security context of the WordPress domain, granting the attacker access to cookies, localStorage, and any authenticated session tokens. The scope change indicated in the CVSS vector means the exploit can affect resources beyond the vulnerable plugin itself.

With an EPSS score of approximately 0.275% and percentile of 19.232, the vulnerability has a low predicted exploitation likelihood, but the ease of reflected XSS delivery through phishing keeps the risk relevant.

Root Cause

The root cause is missing or insufficient output escaping when the plugin echoes request parameters back into page markup. WordPress provides functions such as esc_html(), esc_attr(), and esc_url() for context-aware escaping, but the vulnerable plugin does not apply them consistently to reflected input.

Attack Vector

An attacker crafts a URL to a plugin endpoint that includes a JavaScript payload in a reflected parameter. The attacker delivers the URL via phishing email, social media, or a malicious website. When a WordPress user clicks the link, the plugin returns a page containing the unsanitized payload, and the browser executes it. Because the CVSS vector requires user interaction, exploitation depends on social engineering. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-51704

Indicators of Compromise

Web server access logs containing URL parameters with HTML tags, javascript: URIs, or encoded script payloads targeting wp-js-impress endpoints
Referrer headers from unexpected external domains preceding suspicious plugin requests
Unusual outbound requests from WordPress admin sessions to attacker-controlled domains
Unexpected creation of administrator accounts or plugin configuration changes following link clicks

Detection Strategies

Deploy a web application firewall (WAF) with signatures for reflected XSS patterns targeting WordPress plugin parameters
Monitor HTTP request logs for encoded payloads such as %3Cscript%3E, onerror=, or onload= in query strings routed to imPress endpoints
Implement Content Security Policy (CSP) headers and log CSP violation reports to identify injection attempts

Monitoring Recommendations

Enable verbose logging on the WordPress server and forward logs to a centralized SIEM for correlation
Alert on any HTTP 200 responses returning request parameters containing script-related keywords
Track authentication events and administrative actions occurring within short intervals after external referrer clicks

How to Mitigate CVE-2024-51704

Immediate Actions Required

Deactivate and remove the imPress (wp-js-impress) plugin from all WordPress installations until a patched version is released
Audit WordPress user accounts for unauthorized administrator additions or role changes
Force password resets for administrative users who may have clicked suspicious links
Rotate WordPress authentication salts and session cookies via wp-config.php

Patch Information

No patched version is currently documented in the CVE data. All versions up to and including 0.1.4 remain vulnerable. Consult the Patchstack Vulnerability Report for the latest remediation status.

Workarounds

Remove the plugin entirely if a fixed version is not available
Deploy a WAF rule blocking requests containing script tags or JavaScript event handlers in query parameters targeting wp-js-impress paths
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Train users to avoid clicking untrusted links pointing to the WordPress site's domain

bash

# Example WAF rule (ModSecurity) blocking common reflected XSS payloads on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-js-impress/" \
  "chain,id:1005170,phase:2,deny,status:403,msg:'Blocked reflected XSS attempt on imPress plugin'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"