CVE-2024-8117: WP Extended Reflected XSS Vulnerability

CVE-2024-8117 Overview

CVE-2024-8117 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Ultimate WordPress Toolkit – WP Extended plugin. The flaw affects all plugin versions up to and including 3.0.8. It stems from insufficient input sanitization and output escaping on the selected_option parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The issue is tracked under [CWE-79] and impacts WordPress sites running the vulnerable plugin.

Critical Impact
Successful exploitation lets unauthenticated attackers execute arbitrary scripts in the victim's browser, enabling session theft, credential harvesting, and administrative account takeover through user interaction.

Affected Products

WP Extended (Ultimate WordPress Toolkit) plugin versions ≤ 3.0.8
WordPress sites with the wpextended plugin installed and active
Any administrator or user account accessible through a browser session on an affected site

Discovery Timeline

2024-09-04 - CVE-2024-8117 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8117

Vulnerability Analysis

The vulnerability resides in the WP Extended plugin's snippets module, specifically in the code path that handles the selected_option request parameter. The plugin echoes the parameter's value back into rendered HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). As a result, attacker-controlled content is interpreted as active HTML and JavaScript by the browser.

Because the attack is reflected, exploitation requires the victim to click a crafted URL or interact with attacker-supplied content. The scope is marked as changed, meaning script execution can affect resources beyond the vulnerable component, including the WordPress admin session context. Attackers commonly leverage such flaws to hijack administrator sessions, plant persistent backdoors through the plugin editor, or pivot to full site compromise.

Root Cause

The root cause is missing input sanitization and output escaping on the selected_option parameter within the plugin's snippets handler, referenced in includes/modules/core_extensions/wpext_snippets/wpext_snippets.php. WordPress provides context-aware escaping APIs, but the vulnerable code path passes user-supplied data directly into the response body without them.

Attack Vector

Exploitation occurs over the network without authentication but requires user interaction. An attacker crafts a URL containing a malicious payload in the selected_option query parameter and delivers it via phishing email, social media, or a malicious page. When an authenticated WordPress user, particularly an administrator, clicks the link, the injected script executes in the context of the site's origin. See the Wordfence Vulnerability Report and the vulnerable code reference for technical details.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-8117

Indicators of Compromise

HTTP requests containing suspicious payloads such as <script>, onerror=, or javascript: sequences in the selected_option parameter
Web server access logs showing requests to WP Extended plugin endpoints with unusually long or URL-encoded query strings
Unexpected creation of WordPress administrator accounts or modifications to the wp_users table shortly after suspicious link click activity
Outbound requests from browser sessions to attacker-controlled domains referenced in the injected payload

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the selected_option parameter for script tags and HTML event handlers
Correlate email gateway telemetry with web access logs to identify phishing URLs targeting WP Extended endpoints
Monitor endpoint browser processes for anomalous script execution originating from WordPress admin sessions

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and admin interfaces
Alert on any 200-response requests to WP Extended plugin URLs containing angle brackets or URL-encoded %3C%3E sequences in query strings
Track WordPress audit logs for administrative changes performed shortly after external referrer redirects

How to Mitigate CVE-2024-8117

Immediate Actions Required

Upgrade the WP Extended plugin to a version newer than 3.0.8 that includes the fix committed in WordPress plugin changeset 3145430
Force reauthentication for all WordPress administrator accounts and rotate any secrets managed through the site
Review recent administrator activity and installed plugins for evidence of unauthorized changes

Patch Information

The vendor addressed the vulnerability in the WP Extended plugin repository under changeset 3145430. Site owners should update to the latest available plugin release through the WordPress admin dashboard or via WP-CLI. Verify the installed version reports higher than 3.0.8 after the update.

Workarounds

Temporarily deactivate the WP Extended plugin until the patched version is applied
Deploy WAF rules that block or sanitize requests containing HTML control characters in the selected_option parameter
Restrict administrative access to the WordPress dashboard by IP allowlist to reduce phishing exposure

bash

# Update the WP Extended plugin using WP-CLI
wp plugin update wpextended --path=/var/www/html

# Verify installed version is greater than 3.0.8
wp plugin get wpextended --field=version --path=/var/www/html