CVE-2024-54422: Evernote Sync XSS Vulnerability

CVE-2024-54422 Overview

CVE-2024-54422 is a reflected cross-site scripting (XSS) vulnerability in the tgw365 Evernote Sync evernote-sync plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All versions up to and including 3.0.0 are affected. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of a victim who clicks the link. Successful exploitation requires user interaction and operates with a changed security scope, enabling access to data and actions across the targeted WordPress site.

Critical Impact
Attackers can hijack authenticated WordPress sessions, steal cookies, perform actions on behalf of administrators, or redirect users to attacker-controlled pages by tricking them into clicking a crafted link.

Affected Products

WordPress plugin: tgw365 Evernote Sync (evernote-sync)
All versions from initial release through 3.0.0
WordPress installations with the plugin enabled and reachable over the network

Discovery Timeline

2024-12-16 - CVE-2024-54422 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54422

Vulnerability Analysis

The vulnerability is a reflected XSS issue classified under [CWE-79]. The plugin echoes attacker-controlled request parameters back into the rendered HTML response without proper output encoding or input sanitization. An attacker crafts a URL containing JavaScript payloads that the plugin reflects directly into the page. When a victim loads the URL, the browser parses the injected script in the security context of the WordPress site.

Exploitation requires user interaction, typically through social engineering such as phishing emails or malicious links posted on forums. The scope is changed, meaning the injected script can act on resources beyond the vulnerable component itself. Impact on confidentiality, integrity, and availability is low individually but enables session theft, defacement, and unauthorized actions when the victim holds elevated privileges. The EPSS score is 0.403% with a percentile of 31.9.

Root Cause

The root cause is missing output encoding on user-supplied request parameters processed by the plugin. The plugin trusts data received over HTTP and inserts it into the HTML response without applying WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> content and HTML event handlers to survive into the rendered DOM.

Attack Vector

The attack vector is network-based and requires no authentication. The attacker delivers a crafted URL containing a JavaScript payload in a vulnerable parameter to a target user. When the user clicks the link while browsing the affected WordPress site, the plugin reflects the payload into the response and the browser executes it. Refer to the Patchstack advisory for parameter-level technical details.

// No verified public exploit code is available for CVE-2024-54422.
// See the Patchstack advisory linked above for technical specifics.

Detection Methods for CVE-2024-54422

Indicators of Compromise

HTTP GET requests to plugin endpoints containing <script>, onerror=, onload=, or javascript: substrings in query parameters
Web server access logs showing URL-encoded payloads such as %3Cscript%3E targeting evernote-sync paths
Outbound browser requests from authenticated WordPress sessions to unfamiliar domains following a click on a referral link
Unexpected administrator actions in WordPress audit logs immediately after a session interacted with a crafted URL

Detection Strategies

Inspect WordPress and reverse-proxy logs for query strings containing HTML tags or JavaScript event handlers directed at evernote-sync plugin paths
Deploy a Web Application Firewall (WAF) rule that flags reflected payloads where request parameters appear unescaped in response bodies
Correlate referer headers from external domains with subsequent privileged WordPress actions to surface social-engineering chains

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and forward logs to a centralized analytics platform for query-string inspection
Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts on plugin pages
Track plugin version inventory across WordPress sites and alert when evernote-sync<= 3.0.0 is installed

How to Mitigate CVE-2024-54422

Immediate Actions Required

Deactivate the evernote-sync plugin until a fixed version is confirmed available from the vendor
Remove the plugin from any WordPress sites that no longer require Evernote synchronization
Force a password reset and session invalidation for administrators who may have clicked suspicious links
Apply a WAF rule that blocks HTML and JavaScript tokens in query parameters targeting the plugin

Patch Information

At the time of the NVD entry, the vulnerability affects Evernote Sync through 3.0.0 and no fixed version is identified in the published references. Consult the Patchstack advisory for the latest remediation status from the plugin maintainer.

Workarounds

Uninstall the plugin entirely if a patched release is not available
Restrict access to WordPress administrative pages by IP allowlist to reduce the population of users exposed to crafted links
Implement a strict Content Security Policy that disallows inline scripts and unknown script sources on the affected site
Train administrators to avoid clicking unsolicited links that target the WordPress instance

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate evernote-sync
wp plugin delete evernote-sync

# Example ModSecurity rule to block reflected XSS payloads on plugin paths
SecRule REQUEST_URI "@contains evernote-sync" \
  "chain,id:1005422,phase:2,deny,status:403,msg:'Block XSS against evernote-sync (CVE-2024-54422)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni"