CVE-2024-8799: Custom Banners WordPress Plugin XSS Vulnerability

CVE-2024-8799 Overview

The Custom Banners plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.3. The flaw stems from the use of the add_query_arg function without proper escaping on the URL. Unauthenticated attackers can inject arbitrary web scripts that execute when a targeted user clicks a crafted link. The vulnerability is tracked under CWE-79 and impacts installations maintained by the goldplugins vendor.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session by luring authenticated users to click a malicious link, enabling session theft, account takeover, or administrative action hijacking.

Affected Products

Goldplugins Custom Banners plugin for WordPress, all versions through 3.3
WordPress sites with the vulnerable plugin activated
Administrator and editor accounts targeted through social engineering

Discovery Timeline

2024-10-01 - CVE-2024-8799 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8799

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the Custom Banners plugin. The plugin passes the current request URL into WordPress's add_query_arg function without sanitizing or escaping the returned value before rendering it in HTML output. When user-controlled input flows into the page unescaped, an attacker can inject JavaScript that executes in the victim's browser context.

Exploitation requires user interaction, typically clicking a crafted link. The scope of impact extends beyond the vulnerable component because injected script runs with the privileges of the authenticated victim, including any WordPress administrator who follows the link.

Root Cause

The root cause resides in the plugin's TGM Plugin Activation library integration at include/tgmpa/init.php. The add_query_arg function returns the current URL with an appended query parameter, and this return value is not passed through esc_url or a comparable escaping routine before being echoed into an HTML attribute. The absence of output encoding allows arbitrary HTML and JavaScript payloads embedded in request parameters to render as executable content.

Attack Vector

The attack requires an unauthenticated attacker to craft a URL targeting a page that invokes the vulnerable add_query_arg call. The attacker delivers the URL through phishing email, social media, or a malicious webpage. When a signed-in WordPress user clicks the link, the reflected payload executes in their browser, granting the attacker the ability to perform actions in the site context, exfiltrate session cookies, or pivot to further attacks against the administrative interface.

The vulnerability description and code path are documented in the WordPress Plugin Code Library and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-8799

Indicators of Compromise

Web server access logs containing URL parameters with encoded <script> tags, javascript: schemes, or event handlers such as onerror= and onload=
Requests to WordPress admin pages that include unusually long or encoded query strings referencing plugin paths under custom-banners
Referer headers pointing to external domains preceding administrative actions

Detection Strategies

Inventory WordPress installations and identify sites running Custom Banners version 3.3 or earlier
Deploy web application firewall rules that inspect query strings for reflected XSS payload signatures
Monitor for outbound requests from browser sessions to attacker-controlled infrastructure following administrator activity

Monitoring Recommendations

Enable WordPress audit logging to record administrative actions and correlate them with suspicious inbound URLs
Aggregate web server and WAF logs into a centralized platform for behavioral analysis of parameter tampering patterns
Alert on browser telemetry that indicates script execution from unexpected origins on WordPress admin pages

How to Mitigate CVE-2024-8799

Immediate Actions Required

Identify all WordPress sites running the Custom Banners plugin and confirm the installed version
Deactivate the plugin on any site running version 3.3 or earlier until a patched release is applied
Instruct administrators to avoid clicking untrusted links while authenticated to WordPress

Patch Information

No vendor patch was referenced in the NVD data at the time of publication. Site owners should monitor the plugin listing on WordPress.org and the Wordfence Vulnerability Analysis advisory for a fixed release, and upgrade immediately once available. Any fix should apply esc_url or equivalent escaping to the add_query_arg return value.

Workarounds

Restrict wp-admin access to trusted IP ranges using web server or firewall rules
Deploy a web application firewall with reflected XSS signatures targeting WordPress plugin parameters
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Require administrators to use separate browser profiles or sessions for WordPress management

bash

# Example nginx rule to block common reflected XSS payloads in query strings
if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
    return 403;
}