CVE-2024-8738: Seriously Simple Stats XSS Vulnerability

CVE-2024-8738 Overview

CVE-2024-8738 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Seriously Simple Stats plugin for WordPress, developed by Castos. All versions up to and including 1.6.0 are affected. The flaw stems from the use of add_query_arg without proper URL escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction, such as clicking a crafted link. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject JavaScript that executes in the browser of any user who clicks a malicious link, enabling session theft, credential harvesting, or administrative account takeover.

Affected Products

Castos Seriously Simple Stats plugin for WordPress, all versions through 1.6.0
WordPress sites with the plugin installed and activated
Any user session interacting with a crafted URL targeting a vulnerable site

Discovery Timeline

2024-09-24 - CVE-2024-8738 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8738

Vulnerability Analysis

The vulnerability resides in the plugin's use of the WordPress add_query_arg() function without escaping the output. This function appends query parameters to a URL derived from the current request. When the resulting URL is echoed into HTML attributes such as href or action without sanitization, attacker-controlled input from the request URI is reflected directly into the page.

An attacker crafts a URL containing JavaScript payloads in the query string or path. When a user visits the malicious link, the injected script executes within the site's origin. Because the payload runs in the victim's authenticated session context, it can perform actions on behalf of the user, exfiltrate cookies, or manipulate page content.

The plugin issue was tracked and fixed in the WordPress plugin repository changeset. Additional analysis is available in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing output escaping around a URL constructed with add_query_arg. WordPress documentation explicitly warns that this function does not sanitize input and requires developers to wrap output with esc_url() or similar functions. The affected code path in class-ssp-stats.php around line 1296 emits the URL without applying escaping. See the WordPress Plugin Code Review for the exact location.

Attack Vector

Exploitation requires an attacker to send a victim a crafted link pointing to the vulnerable WordPress site. The malicious query parameters carry the XSS payload. When the victim clicks the link, the plugin renders the reflected content, executing attacker-controlled JavaScript in the victim's browser. No authentication is required from the attacker, but user interaction is mandatory.

No public proof-of-concept exploit is listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-8738

Indicators of Compromise

HTTP requests to WordPress endpoints containing script tags, event handlers (onerror=, onload=), or URL-encoded JavaScript in query parameters
Web server access logs showing referrers from unfamiliar domains linking to plugin-associated URLs
Unexpected outbound requests from browser sessions to attacker-controlled infrastructure following a click event

Detection Strategies

Inspect WordPress access logs for reflected payloads in URLs referencing pages that render Seriously Simple Stats output
Deploy web application firewall (WAF) rules that flag XSS payload patterns in query strings targeting WordPress
Correlate authenticated administrative session activity with anomalous JavaScript execution or DOM manipulation events

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on WordPress pages
Monitor plugin version inventory across managed WordPress installations to identify hosts still running vulnerable releases
Alert on administrative account activity originating from unusual sessions or IP addresses shortly after link-click telemetry

How to Mitigate CVE-2024-8738

Immediate Actions Required

Update the Seriously Simple Stats plugin to a version above 1.6.0 that incorporates the fix from the referenced changeset
Audit all WordPress sites for the presence of the vulnerable plugin using WP-CLI or the admin plugins page
Rotate administrator credentials and invalidate active sessions if suspicious link-click activity is observed

Patch Information

The fix is available in the WordPress plugin repository changeset. Site administrators should apply the update through the WordPress admin dashboard or automated update tooling. Verify the installed version after patching to confirm remediation.

Workarounds

Deactivate and remove the Seriously Simple Stats plugin until the patched version can be deployed
Deploy a WAF ruleset that blocks XSS payloads in query parameters targeting /wp-admin/ and plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Update the plugin using WP-CLI
wp plugin update seriously-simple-stats

# Verify the installed version
wp plugin get seriously-simple-stats --field=version

# Deactivate as a temporary workaround if patching is delayed
wp plugin deactivate seriously-simple-stats