CVE-2024-8741: Beam Me Up Scotty WordPress Plugin XSS Flaw

CVE-2024-8741 Overview

CVE-2024-8741 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Beam me up Scotty – Back to Top Button plugin for WordPress. The flaw affects all versions up to and including 1.0.21. It stems from the use of add_query_arg without proper URL escaping in the plugin's tabs.php template. Unauthenticated attackers can inject arbitrary JavaScript that executes in the victim's browser when the victim clicks a crafted link. The vulnerability is classified under [CWE-79] and requires user interaction to trigger.

Critical Impact

Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling session theft, phishing, and redirection when a user clicks a malicious link.

Affected Products

• Outtheboxthemes Beam me up Scotty – Back to Top Button plugin for WordPress
• All versions through 1.0.21
• WordPress sites running the vulnerable plugin release

Discovery Timeline

• 2024-09-25 - CVE-2024-8741 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8741

Vulnerability Analysis

The vulnerability resides in the plugin file library/template-parts/tabs.php at line 27. The code passes the current request URL to add_query_arg() without escaping the returned value before rendering it in an HTML context. WordPress's add_query_arg function reflects arbitrary query parameters from the incoming request back into the URL it constructs. When developers echo that URL into page output without applying esc_url() or esc_attr(), attacker-controlled input flows directly into the DOM. This is a well-known unsafe pattern documented across the WordPress plugin ecosystem.

Root Cause

The root cause is missing output encoding. The plugin trusts the URL produced by add_query_arg and emits it into an attribute or anchor context without sanitization. Because query string parameters are attacker-controlled, an attacker can append parameters containing HTML or JavaScript payloads. The rendered response then contains the injected content in a location where it is parsed as markup.

Attack Vector

Exploitation requires an attacker to craft a URL pointing to a page on the affected WordPress site that renders the vulnerable tabs.php template. The attacker appends malicious query parameters to that URL. The attacker then delivers the link through phishing, forum posts, or malvertising. When an authenticated or unauthenticated user clicks the link, the injected script executes in their browser under the site's origin. Consequences include session cookie theft, forced administrative actions via CSRF-style requests, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure.

No verified public proof-of-concept code is available for CVE-2024-8741. For the specific vulnerable code path, see the WordPress Plugin Code Snippet and the Wordfence Vulnerability Intelligence Report.

Detection Methods for CVE-2024-8741

Indicators of Compromise

• Web server access logs containing requests to pages that load the plugin's tabs template with query strings holding HTML-encoded payloads such as %3Cscript%3E, onerror=, or javascript:.
• Referrer headers showing users arriving at the WordPress site from unknown external domains followed by requests to plugin-rendered endpoints.
• Unexpected outbound requests from user browsers to attacker-controlled domains after visiting site pages that include the plugin.

Detection Strategies

• Inventory WordPress installations and identify sites running beam-me-up-scotty at version 1.0.21 or earlier using plugin version scanners.
• Deploy web application firewall (WAF) rules that block query strings containing script tags, event handlers, or javascript: URIs on pages served by WordPress.
• Correlate suspicious URL patterns in HTTP logs with subsequent unusual authentication or administrative activity in WordPress audit logs.

Monitoring Recommendations

• Alert on WordPress admin sessions initiated shortly after users load pages containing suspicious query parameters.
• Monitor for changes to WordPress user roles, new administrator accounts, or unexpected plugin installations following external link clicks.
• Track browser telemetry for content-security-policy violations on pages that embed the plugin output.

How to Mitigate CVE-2024-8741

Immediate Actions Required

• Update the Beam me up Scotty – Back to Top Button plugin to a version newer than 1.0.21 that includes the fix from changeset 3156146.
• Audit WordPress user accounts and rotate credentials for any administrator whose session may have been active during a suspected exploit window.
• Enforce a strict Content Security Policy (CSP) on the WordPress site to limit the impact of reflected script execution.

Patch Information

The vendor addressed the vulnerability in the plugin trunk by adding proper escaping around the add_query_arg output in library/template-parts/tabs.php. Site owners should install the patched release published after WordPress plugin changeset 3156146. Verify the installed version through the WordPress admin plugins page after upgrading.

Workarounds

• Deactivate and remove the Beam me up Scotty plugin until the patched version is installed if immediate updating is not possible.
• Deploy WAF signatures that block requests containing common XSS payload patterns in query parameters targeting WordPress front-end pages.
• Apply a Content Security Policy header that disallows inline scripts and restricts script sources to trusted origins.

# Example CSP header (nginx) to reduce reflected XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;