CVE-2024-56038: SendSMS Plugin XSS Vulnerability

CVE-2024-56038 Overview

CVE-2024-56038 is a reflected Cross-Site Scripting (XSS) vulnerability in the catalinsendsms SendSMS plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.2.9. The plugin fails to properly neutralize user-controllable input before reflecting it back in generated web pages, allowing attackers to inject arbitrary JavaScript [CWE-79].

The issue requires user interaction, typically convincing a victim to click a crafted link. Successful exploitation runs attacker-controlled script in the victim's browser session, with potential impact on confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact

An unauthenticated attacker can execute arbitrary JavaScript in the browser of any user who interacts with a crafted SendSMS plugin URL, enabling session theft, admin account takeover, and persistent site compromise.

Affected Products

• SendSMS WordPress plugin (sendsms) by catalinsendsms
• All versions from initial release through 1.2.9
• WordPress installations with the vulnerable plugin activated

Discovery Timeline

• 2025-01-02 - CVE-2024-56038 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-56038

Vulnerability Analysis

The SendSMS plugin reflects request parameters into HTML responses without applying output encoding or sanitization. When a victim loads a URL containing crafted input, the plugin echoes that input directly into the rendered page, causing the browser to parse and execute injected script.

Reflected XSS in a WordPress administrative context is particularly impactful. If a logged-in administrator visits a malicious link, the injected script runs with that administrator's privileges, enabling actions such as creating new admin accounts, modifying plugin code, or installing persistent backdoors. The vulnerability changes scope because script executes within the trusted origin of the WordPress site.

The Exploit Prediction Scoring System (EPSS) places the probability of observed exploitation at 0.313%. No public proof-of-concept exploit code is currently catalogued, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin treats request data as safe HTML rather than escaping characters such as <, >, ", and ' before insertion into the response. WordPress provides functions like esc_html(), esc_attr(), and wp_kses() for context-appropriate escaping, but the affected code paths do not apply them.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting a vulnerable plugin endpoint with a JavaScript payload embedded in a reflected parameter. The attacker then delivers this URL through phishing email, social media, or a malicious third-party site. When a victim with an active WordPress session clicks the link, the browser executes the payload in the site's origin. See the Patchstack Vulnerability Report for additional technical context.

// No verified public proof-of-concept code is available.
// The vulnerability is triggered by sending crafted input via a
// vulnerable plugin parameter that is reflected unsanitized into
// the HTML response.

Detection Methods for CVE-2024-56038

Indicators of Compromise

• Web server access logs containing requests to SendSMS plugin endpoints with parameter values containing <script>, javascript:, onerror=, onload=, or URL-encoded equivalents (%3Cscript%3E).
• Unexpected WordPress administrator accounts, modified theme or plugin files, or new scheduled tasks (wp_cron entries) following user interaction with suspicious links.
• Outbound HTTP requests from administrator browsers to unknown domains immediately after visiting plugin URLs.

Detection Strategies

• Inspect HTTP request and response pairs for the SendSMS plugin and flag responses that echo request parameters containing HTML or JavaScript tokens.
• Deploy a Web Application Firewall (WAF) with rules matching common XSS payload patterns targeting WordPress plugin parameters.
• Correlate phishing-style email or messaging telemetry with subsequent administrator clicks on links pointing to the WordPress site.

Monitoring Recommendations

• Enable WordPress activity logging to capture administrator session activity, user creation events, and plugin or theme modifications.
• Monitor browser security telemetry on administrator workstations for unexpected script execution or cross-origin requests originating from the WordPress domain.
• Alert on changes to wp-config.php, plugin files, and the wp_users table outside scheduled maintenance windows.

How to Mitigate CVE-2024-56038

Immediate Actions Required

• Update the SendSMS plugin to a release later than 1.2.9 as soon as the vendor publishes a patched version.
• Deactivate and remove the SendSMS plugin from any WordPress site where it is not actively required.
• Rotate WordPress administrator passwords and invalidate active sessions if administrators may have interacted with suspicious links.

Patch Information

At the time of NVD publication, the advisory lists affected versions through <= 1.2.9. Consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed version and release notes before deploying updates.

Workarounds

• Place a WAF in front of the WordPress site and enable signatures that block reflected XSS payloads on plugin endpoints.
• Enforce a strict Content-Security-Policy HTTP response header that disallows inline scripts and restricts script sources to trusted origins.
• Restrict administrative access to the WordPress dashboard by IP allowlist or VPN to reduce exposure of privileged sessions to phishing-delivered links.

# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate sendsms
wp plugin delete sendsms