CVE-2024-51782: Loginplus Stored XSS Vulnerability

CVE-2024-51782 Overview

CVE-2024-51782 is a stored Cross-Site Scripting (XSS) vulnerability in the Sanjay Prasad Loginplus WordPress plugin. The flaw affects all versions of loginplus up to and including 1.2. The plugin fails to neutralize user-controlled input during web page generation, allowing attackers to persist malicious scripts that execute in the browsers of other users.

The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction but no authentication, and the stored payload crosses a security boundary impacting confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
Attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and arbitrary actions in the WordPress admin context.

Affected Products

Sanjay Prasad Loginplus WordPress plugin versions up to and including 1.2
WordPress installations using the vulnerable loginplus plugin
Any site visitor or administrator rendering the injected content

Discovery Timeline

2024-11-09 - CVE-2024-51782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51782

Vulnerability Analysis

The Loginplus plugin stores attacker-supplied input and later renders it into HTML responses without proper output encoding or sanitization. Because the payload is stored server-side, every subsequent visitor to the affected page triggers script execution. The attack crosses a trust boundary, meaning injected code executes with the privileges of the rendering user, including authenticated administrators.

The Exploit Prediction Scoring System (EPSS) places this issue at 0.259% probability of exploitation within the next 30 days. No public proof-of-concept exploit is currently tracked, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient sanitization of user input before it is written to persistent storage, combined with missing output encoding when that data is rendered into HTML. Standard WordPress functions such as sanitize_text_field() on input and esc_html() or esc_attr() on output were not applied to the affected fields in the loginplus plugin through version 1.2.

Attack Vector

An unauthenticated remote attacker submits crafted input containing HTML or JavaScript through a plugin-exposed form or endpoint. The payload is stored by the plugin and later served to any user who loads the affected page. When a victim interacts with the page, the script executes in their browser session. The Patchstack advisory provides additional technical context for the affected request path. See the Patchstack XSS Vulnerability Report for details.

The vulnerability is described in prose because no verified public exploit code is available.

Detection Methods for CVE-2024-51782

Indicators of Compromise

Unexpected <script>, onerror=, or onload= strings stored within Loginplus plugin database tables or options
Outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages
New or modified WordPress administrator accounts following access to a page rendered by Loginplus
HTTP POST requests containing encoded JavaScript payloads targeting Loginplus endpoints

Detection Strategies

Review WordPress database fields populated by the loginplus plugin for HTML tags and JavaScript event handlers
Inspect web server access logs for POST requests to plugin endpoints containing URL-encoded <script> or javascript: patterns
Deploy a Web Application Firewall (WAF) ruleset that flags XSS payload signatures targeting WordPress plugin paths
Compare installed plugin version against 1.2 to identify vulnerable instances at scale

Monitoring Recommendations

Alert on creation of WordPress administrator accounts that do not match change-management records
Monitor browser-side telemetry for script execution originating from WordPress admin pages
Track plugin file integrity using checksums and alert on unexpected modifications to loginplus files
Forward WordPress and web server logs to a centralized data lake for correlation across multiple sites

How to Mitigate CVE-2024-51782

Immediate Actions Required

Identify all WordPress instances running the Loginplus plugin at version 1.2 or earlier
Deactivate and remove the plugin until a patched release is confirmed available from the vendor
Rotate WordPress administrator credentials and invalidate active sessions on affected sites
Audit user accounts and stored plugin data for evidence of injected payloads

Patch Information

At the time of NVD publication, the advisory indicates the vulnerability affects Loginplus from n/a through <= 1.2. Administrators should consult the Patchstack XSS Vulnerability Report for the current fixed version status and apply any vendor-provided update immediately.

Workarounds

Disable the loginplus plugin until a fixed version is verified
Apply WAF rules that strip or block HTML and JavaScript content in requests to plugin endpoints
Restrict access to plugin-exposed forms using IP allowlisting where the deployment permits
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on affected pages

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate loginplus
wp plugin delete loginplus

# Verify plugin is no longer installed
wp plugin list --name=loginplus