CVE-2024-8119: WP Extended Plugin XSS Vulnerability

CVE-2024-8119 Overview

CVE-2024-8119 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Ultimate WordPress Toolkit – WP Extended plugin for WordPress. The flaw affects all versions up to and including 3.0.8. It stems from insufficient input sanitization and output escaping on the page parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The issue is tracked under [CWE-79] and mapped to component wpextended:wp_extended.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in the context of an authenticated administrator's browser session, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure.

Affected Products

WP Extended (Ultimate WordPress Toolkit) plugin for WordPress
All versions up to and including 3.0.8
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2024-09-04 - CVE-2024-8119 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8119

Vulnerability Analysis

The vulnerability is a Reflected XSS issue introduced by unsafe handling of the page query parameter in the WP Extended plugin. The plugin reflects the parameter value back into the rendered HTML response without applying proper sanitization or output escaping. An attacker can craft a URL that embeds JavaScript payloads in the page parameter. When a logged-in user, typically an administrator, follows the link, the payload executes under the origin of the WordPress site. Because the vulnerable code path is reachable without authentication, attackers do not need existing credentials to weaponize the flaw. User interaction is required, so exploitation relies on phishing or social engineering to deliver the malicious link.

Root Cause

The root cause is missing input sanitization and output escaping in the plugin's snippets module, specifically in includes/modules/core_extensions/wpext_snippets/wp-extend-module-listing.php. Values supplied through the page request parameter are echoed into HTML attributes or markup without functions such as esc_attr(), esc_html(), or sanitize_text_field(). This allows script content to break out of its expected context and execute in the browser.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL targeting a WordPress site running a vulnerable version of WP Extended, embedding a JavaScript payload in the page parameter. The attacker delivers the URL through email, chat, or a malicious web page. When an authenticated user, especially an administrator, visits the link, the injected script executes in their browser session. Payloads can steal session cookies, submit administrative forms via XMLHttpRequest, or pivot to install malicious plugins. The scope-changed component of the vulnerability reflects the ability to affect resources beyond the vulnerable component itself.

Refer to the WordPress Plugin Code Listing and the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-8119

Indicators of Compromise

Web server access logs containing requests to wp-admin/admin.php with a page parameter that includes <script>, javascript:, onerror=, or URL-encoded variants such as %3Cscript%3E.
Referer headers originating from external domains linking directly to admin pages of the WordPress installation.
Unexpected outbound requests from administrator browsers to unknown domains shortly after visiting the site.
New administrative accounts, plugin installs, or modified theme files that correlate with admin session activity following a suspicious link click.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that flags reflected <script> and event-handler payloads on page parameters targeting /wp-admin/.
Inspect WordPress plugin inventories to identify sites running wp_extended at version 3.0.8 or earlier.
Correlate authenticated admin sessions with anomalous DOM-based network requests observed in endpoint browser telemetry.

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress hosts and forward logs to a centralized analytics platform for query and alerting.
Monitor for creation of WordPress users with administrator role and for modifications to wp_options fields such as siteurl or home.
Alert on plugin or theme file changes outside of scheduled maintenance windows.

How to Mitigate CVE-2024-8119

Immediate Actions Required

Update the WP Extended plugin to a version later than 3.0.8 on all WordPress installations.
Audit administrator accounts and rotate credentials for any user who may have interacted with suspicious links.
Invalidate active WordPress sessions by rotating authentication salts in wp-config.php.
Review recent plugin, theme, and user changes for indicators of post-exploitation activity.

Patch Information

The vendor addressed the vulnerability in a subsequent release of the plugin. Details of the fix are available in the WordPress Changeset Update and the Wordfence Vulnerability Analysis. Apply the update through the WordPress plugin management interface or WP-CLI.

Workarounds

Deactivate and remove the WP Extended plugin until the patched version can be deployed.
Deploy WAF rules that block requests containing script tags or JavaScript event handlers in query strings targeting /wp-admin/.
Enforce Content Security Policy (CSP) headers that restrict inline script execution on WordPress admin pages.
Restrict access to /wp-admin/ by IP allowlisting where administrative access originates from known networks.

bash

# Update the WP Extended plugin using WP-CLI
wp plugin update wpextended

# Verify the installed version is greater than 3.0.8
wp plugin get wpextended --field=version