CVE-2024-56035: Upload Scanner Reflected XSS Vulnerability

CVE-2024-56035 Overview

CVE-2024-56035 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Kurt Payne Upload Scanner plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Affected versions include Upload Scanner from initial release through version 1.2.

An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and changes the security scope, allowing impact beyond the vulnerable component.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of the targeted WordPress user.

Affected Products

Kurt Payne Upload Scanner plugin for WordPress
All versions from initial release through 1.2
WordPress sites with the upload-scanner plugin installed and active

Discovery Timeline

2025-01-02 - CVE-2024-56035 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-56035

Vulnerability Analysis

The Upload Scanner plugin fails to sanitize or encode user-controlled input before reflecting it into HTTP response output. This creates a classic Reflected XSS condition where the browser interprets attacker-supplied content as executable code rather than data.

The vulnerability falls under the [CWE-79] category, which covers improper neutralization of input during web page generation. Because the attack vector is network-based and requires no privileges, any unauthenticated attacker can construct a malicious payload. The scope change indicated in the vulnerability metrics means the compromised browser context extends beyond the plugin itself, affecting the entire WordPress administrative session.

Root Cause

The root cause is the absence of proper output encoding when rendering user-controlled parameters back into HTML responses. WordPress plugins must apply context-appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses() before echoing request data. The Upload Scanner plugin omits these protections in at least one request handler through version 1.2.

Attack Vector

An attacker delivers a crafted URL containing JavaScript payloads in a vulnerable parameter through phishing emails, malicious websites, or social engineering. When a logged-in WordPress administrator clicks the link, the plugin reflects the payload into the response. The browser executes the script under the WordPress origin, granting the attacker access to session cookies, CSRF tokens, and the ability to invoke privileged administrative actions.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-56035

Indicators of Compromise

Inbound HTTP requests to WordPress endpoints containing <script>, javascript:, onerror=, or onload= strings in query parameters targeting the upload-scanner plugin paths
Unusual referrer headers pointing to external phishing domains preceding administrator logins
Unexpected administrator account creation, plugin installations, or configuration changes following anomalous URL visits

Detection Strategies

Inspect web server access logs for requests to /wp-content/plugins/upload-scanner/ containing encoded or raw HTML and JavaScript syntax
Deploy Web Application Firewall (WAF) rules that detect reflected XSS patterns in query strings and POST bodies
Correlate browser-side Content Security Policy (CSP) violation reports with WordPress administrator activity

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, user creation events, and plugin modifications
Monitor outbound network connections from administrator workstations for callbacks to attacker-controlled infrastructure
Track plugin version inventory across managed WordPress installations to identify hosts running Upload Scanner 1.2 or earlier

How to Mitigate CVE-2024-56035

Immediate Actions Required

Deactivate and remove the Upload Scanner plugin from all WordPress installations until a patched release is verified
Force password resets for all WordPress administrator accounts that may have visited untrusted links
Invalidate active sessions and rotate authentication cookies and API keys

Patch Information

At the time of publication, no fixed version beyond 1.2 is referenced in the available advisory. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest remediation guidance and patched version availability.

Workarounds

Remove the upload-scanner plugin directory from the WordPress installation as a permanent mitigation if no patch is available
Implement a strict Content Security Policy (CSP) that blocks inline script execution on WordPress administrative pages
Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF tier
Train administrators to avoid clicking unsolicited links and to verify URLs before authenticating to WordPress

bash

# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate upload-scanner
wp plugin delete upload-scanner