CVE-2024-56030: 10CentMail Reflected XSS Vulnerability

CVE-2024-56030 Overview

CVE-2024-56030 is a reflected cross-site scripting (XSS) vulnerability in the Carver Lab 10CentMail WordPress plugin (10centmail-subscription-management-and-analytics). The flaw affects all versions up to and including 2.1.50. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted URL. This issue is tracked under CWE-79 and requires user interaction to exploit.

Critical Impact

An attacker can deliver a crafted link that executes arbitrary JavaScript in the victim's browser session, enabling session theft, credential harvesting, or unauthorized actions against the WordPress site under the victim's privileges.

Affected Products

• Carver Lab 10CentMail Subscription Management and Analytics plugin for WordPress
• All plugin versions from initial release through 2.1.50
• WordPress sites with the 10centmail-subscription-management-and-analytics plugin installed and active

Discovery Timeline

• 2025-01-02 - CVE-2024-56030 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-56030

Vulnerability Analysis

The 10CentMail plugin reflects user-controlled input back into HTTP responses without applying proper output encoding or input sanitization. When a victim loads a URL containing an attacker-supplied payload, the unsanitized value renders inside the HTML response and executes as script content in the victim's browser. Because the vulnerability has a changed scope, a successful payload can impact resources beyond the vulnerable component, such as the WordPress administrative session or other browser-trusted contexts. Exploitation requires user interaction, typically by clicking a malicious link delivered through phishing or other social engineering channels. The EPSS score is 0.195% at the 41.25 percentile, indicating limited observed exploitation activity at this time.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. The plugin accepts request parameters and writes their values into the response HTML without escaping characters such as <, >, and ". This allows attacker-controlled HTML and JavaScript to be parsed and executed by the browser instead of being treated as inert text.

Attack Vector

An attacker crafts a URL pointing to a vulnerable plugin endpoint and embeds JavaScript inside a reflected parameter. The attacker then delivers this URL to a target, often a logged-in WordPress administrator or subscriber. When the victim clicks the link, the payload executes in their browser under the origin of the WordPress site. This execution context allows the attacker to steal cookies, perform actions on behalf of the victim, or pivot toward administrative compromise. Refer to the Patchstack WordPress Vulnerability Advisory for technical details.

Detection Methods for CVE-2024-56030

Indicators of Compromise

• HTTP request logs containing reflected parameters with encoded or raw <script>, onerror=, onload=, or javascript: tokens targeting 10CentMail plugin endpoints
• Referrer headers from external domains pointing users to plugin URLs with unusual query strings
• WordPress access logs showing GET requests to plugin paths with abnormally long or HTML-encoded query parameters
• Browser console errors or unexpected outbound requests originating from pages served by the affected plugin

Detection Strategies

• Inspect web server and WordPress logs for query strings containing HTML metacharacters directed at plugin endpoints
• Deploy a web application firewall (WAF) rule set tuned for reflected XSS patterns targeting WordPress plugins
• Monitor for anomalous administrator session activity that follows a click on a suspicious external link
• Correlate phishing email telemetry with subsequent visits to the WordPress site by the recipient

Monitoring Recommendations

• Enable verbose access logging on the WordPress host and forward logs to a centralized analytics platform
• Alert on outbound requests from authenticated browser sessions to attacker-controlled domains shortly after page load
• Track plugin inventory across managed WordPress instances to identify hosts running 10centmail-subscription-management-and-analytics at or below version 2.1.50
• Review Content Security Policy (CSP) violation reports for inline script execution attempts

How to Mitigate CVE-2024-56030

Immediate Actions Required

• Identify all WordPress sites running the 10CentMail plugin and confirm the installed version
• Deactivate the plugin on any site running version 2.1.50 or earlier until a fixed release is applied
• Apply WAF rules that block reflected XSS payloads against plugin endpoints
• Force a password reset and review session tokens for administrators who may have clicked suspicious links

Patch Information

At the time of publication, the Patchstack WordPress Vulnerability Advisory identifies version 2.1.50 as the last vulnerable release. Administrators should monitor the plugin's repository entry for an updated release that addresses CWE-79 and upgrade as soon as a fixed version becomes available.

Workarounds

• Disable or remove the 10CentMail plugin until a patched release is published
• Implement a strict Content Security Policy that blocks inline scripts and untrusted script sources
• Restrict access to WordPress administrative pages by IP allowlist or VPN to reduce phishing exposure
• Train administrators and editors to avoid clicking unsolicited links that reference the WordPress site

# Example: list and deactivate the vulnerable plugin using WP-CLI
wp plugin list --status=active | grep 10centmail-subscription-management-and-analytics
wp plugin deactivate 10centmail-subscription-management-and-analytics