CVE-2024-8730: Exit Notifier XSS Vulnerability

CVE-2024-8730 Overview

The Exit Notifier plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.10.4. The flaw stems from the use of the add_query_arg function without proper URL escaping in class-exit-notifier-settings.php. Unauthenticated attackers can inject arbitrary web scripts into pages by crafting malicious URLs. Successful exploitation requires tricking an authenticated user into clicking a specially crafted link. The injected script executes in the victim's browser session under the WordPress site's origin, enabling session theft, administrative action abuse, or content manipulation. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers when users click a malicious link, potentially leading to session hijacking or administrative account takeover on affected WordPress sites.

Affected Products

Cvstech Exit Notifier plugin for WordPress
All versions up to and including 1.10.4
WordPress installations with the Exit Notifier plugin active

Discovery Timeline

2024-09-13 - CVE-2024-8730 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8730

Vulnerability Analysis

The Exit Notifier plugin uses WordPress's add_query_arg function to build URLs in its settings page rendered by class-exit-notifier-settings.php. The plugin does not sanitize or escape the resulting URL before echoing it into HTML output. When a user visits a plugin settings URL containing attacker-controlled query parameters, those parameters are reflected into the page markup without encoding. An attacker crafts a URL containing JavaScript payloads and delivers it via phishing, malicious sites, or social engineering. When the victim clicks the link while authenticated, the browser renders the injected script within the WordPress origin.

Root Cause

The root cause is missing output escaping around add_query_arg return values in the plugin's settings rendering code near line 707 of class-exit-notifier-settings.php. The function preserves untrusted query string parameters from the current request. Without wrapping the output in esc_url() or esc_attr(), injected characters break out of attribute contexts and execute as script.

Attack Vector

Exploitation is network-based and requires user interaction. An unauthenticated attacker constructs a URL pointing to the vulnerable plugin page with a payload appended to a reflected parameter. The attacker delivers the URL to a WordPress administrator or editor. When the target loads the URL in an authenticated session, the reflected script executes with the privileges of that user. Refer to the Wordfence Vulnerability Analysis and the vulnerable source line for technical detail.

Detection Methods for CVE-2024-8730

Indicators of Compromise

Web server access logs containing requests to wp-admin/ pages associated with Exit Notifier settings that include <script>, javascript:, onerror=, or URL-encoded equivalents in query strings.
Referer headers from external domains directing authenticated admins to plugin configuration URLs.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following clicks on suspicious links.

Detection Strategies

Inspect HTTP request logs for query parameters containing HTML or JavaScript metacharacters targeting Exit Notifier endpoints.
Deploy Web Application Firewall (WAF) rules that block reflected XSS payloads in WordPress admin URLs.
Correlate email gateway telemetry with WordPress admin session activity to identify phishing links pointing to affected sites.

Monitoring Recommendations

Monitor WordPress plugin inventory to identify installations running Exit Notifier at or below version 1.10.4.
Alert on administrator sessions issuing unusual outbound requests or Document Object Model changes shortly after navigation.
Track content security policy (CSP) violation reports for inline script execution on admin pages.

How to Mitigate CVE-2024-8730

Immediate Actions Required

Update the Exit Notifier plugin to a version above 1.10.4 that includes the fix from WordPress Changeset 3173864.
Deactivate and remove the plugin if an update is not immediately possible.
Force logout of active administrator sessions and rotate credentials for privileged WordPress accounts.

Patch Information

The vendor addressed the vulnerability in the changeset published to the WordPress plugin repository. The fix applies proper URL escaping around the add_query_arg output in the settings class. Site administrators should apply the update through the WordPress plugin management interface or by pulling the latest release from the plugin trunk.

Workarounds

Restrict access to WordPress admin pages using IP allowlisting at the web server or WAF layer.
Enforce a strict Content Security Policy that disallows inline script execution on wp-admin pages.
Train administrators to avoid clicking unsolicited links to their own WordPress admin URLs.
Require reauthentication for sensitive administrative actions to limit impact of session hijacking.

bash

# Configuration example: enforce CSP header via nginx for wp-admin
location /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}