CVE-2024-54364: Feedpress Generator XSS Vulnerability

CVE-2024-54364 Overview

CVE-2024-54364 is a reflected Cross-Site Scripting (XSS) vulnerability in the Spartac Feedpress Generator WordPress plugin. The flaw affects all plugin versions up to and including 1.2.1. It stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when visited by a target user, executes arbitrary JavaScript in the victim's browser session. Successful exploitation can lead to session hijacking, credential theft, redirection to attacker-controlled sites, or unauthorized actions performed in the context of the authenticated user.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link, potentially compromising WordPress administrator sessions.

Affected Products

Spartac Feedpress Generator WordPress plugin (feedpress-generator)
All versions from initial release through 1.2.1
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2024-12-16 - CVE-2024-54364 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54364

Vulnerability Analysis

The vulnerability is a reflected XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The Feedpress Generator plugin accepts user-controlled input through HTTP request parameters and renders that input back into the response page without applying proper output encoding or sanitization. Because the payload is reflected directly from the request, the attack requires user interaction, typically through a crafted URL delivered via phishing or a malicious referrer.

The vulnerability changes scope, meaning injected script can affect resources beyond the vulnerable component itself, including other browser-accessible domains and authenticated WordPress sessions. Confidentiality, integrity, and availability impacts are all limited but present.

Root Cause

The root cause is the absence of contextual output escaping when rendering request-derived values into HTML. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output, but the affected plugin code paths do not consistently apply them. Input received through query strings, form submissions, or similar vectors is concatenated into HTML output, allowing attacker-controlled markup and <script> payloads to execute in the victim's browser.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL pointing to a vulnerable endpoint on a target WordPress site, embedding a JavaScript payload in a reflected parameter. The attacker then distributes the URL via phishing email, social media, or a malicious site. When an authenticated WordPress user, especially an administrator, clicks the link, the payload executes within the site's origin. This grants the attacker access to session cookies not marked HttpOnly, the Document Object Model (DOM), and the ability to issue authenticated requests on behalf of the victim.

No verified public exploit code is currently available. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-54364

Indicators of Compromise

HTTP requests to Feedpress Generator plugin endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= patterns in query parameters
Web server access logs showing unusually long query strings or encoded HTML entities directed at plugin URLs
Reports from users of unexpected pop-ups, redirects, or session anomalies after clicking links referencing the affected WordPress site

Detection Strategies

Inspect WordPress access logs for reflected parameters containing script tags, event handlers, or data: URI schemes targeting plugin paths
Deploy Web Application Firewall (WAF) rules that detect common XSS payload signatures and block requests to feedpress-generator endpoints
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts originating from reflected URLs

Monitoring Recommendations

Centralize WordPress and reverse-proxy logs in a SIEM and alert on XSS payload patterns targeting plugin endpoints
Monitor administrator account activity for unexpected configuration changes, plugin installations, or new user creation following suspicious referrer activity
Track outbound requests from administrator browsers to unknown domains, which may indicate exfiltration via injected scripts

How to Mitigate CVE-2024-54364

Immediate Actions Required

Deactivate and remove the Feedpress Generator plugin until a patched version is confirmed available
Audit WordPress administrator and editor accounts for unauthorized changes, new users, or modified content
Force a password reset and session invalidation for all privileged WordPress accounts on affected sites
Apply WAF rules to block XSS payload patterns targeting the plugin's request parameters

Patch Information

At the time of NVD publication, the advisory indicates the vulnerability affects all versions through 1.2.1 with no fixed version listed. Monitor the Patchstack Vulnerability Report and the official plugin repository for updates. If no patch is forthcoming, replace the plugin with a maintained alternative.

Workarounds

Remove the feedpress-generator plugin entirely if a vendor patch is not available
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure HttpOnly and Secure flags on WordPress authentication cookies to limit the impact of injected scripts
Restrict administrative access to the WordPress dashboard by IP allowlist or VPN to reduce phishing exposure

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate feedpress-generator
wp plugin delete feedpress-generator

# Example nginx rule to block common XSS payloads against the plugin path
# location ~* /wp-content/plugins/feedpress-generator/ {
#     if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
#         return 403;
#     }
# }