CVE-2024-8874: WordPress AJAX Login Plugin XSS Vulnerability

CVE-2024-8874 Overview

CVE-2024-8874 is a Reflected Cross-Site Scripting (XSS) vulnerability in the AJAX Login and Registration modal popup + inline form plugin for WordPress. The flaw affects all versions up to and including 2.24. The plugin uses add_query_arg without properly escaping the URL, allowing script injection via crafted request parameters. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a malicious link. The weakness maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation lets unauthenticated attackers execute arbitrary scripts in a targeted user's browser session, enabling session theft, account takeover, or malicious redirection when the victim clicks a crafted link.

Affected Products

WordPress AJAX Login and Registration modal popup + inline form plugin, all versions through 2.24
WordPress sites with the affected plugin installed and activated
Any WordPress instance exposing plugin-controlled URLs to unauthenticated visitors

Discovery Timeline

2024-11-13 - CVE-2024-8874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8874

Vulnerability Analysis

The vulnerability resides in the plugin's settings handling code, specifically in includes/class-settings.php. The plugin calls WordPress's add_query_arg() function against the current request URL without escaping the returned value before rendering it into HTML output. Because add_query_arg() preserves attacker-controlled query string data from the request, any script payload appended to the URL is reflected back into the response.

Reflected XSS in a WordPress plugin exposes both administrators and site visitors. When executed in an administrator's browser, injected JavaScript can create rogue users, install malicious plugins, or exfiltrate authentication cookies. Against ordinary visitors, it enables phishing overlays and forced redirects. User interaction is required, so exploitation typically relies on phishing or a malicious link on a third-party site.

Root Cause

The root cause is missing output encoding on the return value of add_query_arg(). WordPress developer documentation explicitly warns that this function returns unescaped user input from the request URI. The plugin failed to wrap the return value with esc_url() before echoing it into an HTML attribute, producing a classic reflected XSS sink.

Attack Vector

An attacker crafts a URL to a vulnerable WordPress page that includes a malicious payload in the query string. The attacker delivers this link via email, chat, or a controlled web page. When the victim clicks the link, the plugin reflects the payload into the rendered page, and the browser executes the injected script under the site's origin.

No synthetic exploit code is included. Technical details of the affected code path are available in the WordPress Plugin Settings File and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-8874

Indicators of Compromise

HTTP requests to WordPress pages containing URL-encoded <script>, onerror=, or javascript: payloads in the query string
Web server access logs showing unusual query parameters targeting pages that render plugin-managed settings or login modals
Referer headers originating from external phishing domains delivering crafted plugin URLs
Unexpected creation of WordPress administrator accounts or plugin installs following user link clicks

Detection Strategies

Inspect WordPress access logs for reflected payloads containing HTML tags, event handlers, or encoded script markers in request URIs
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns targeting add_query_arg sinks
Monitor browser Content Security Policy (CSP) violation reports for inline-script violations tied to plugin pages

Monitoring Recommendations

Enable verbose HTTP logging on the WordPress front end and forward logs to a centralized analytics platform for query-string inspection
Correlate outbound requests from user sessions with recent access to plugin-controlled URLs to identify post-exploitation callbacks
Track WordPress admin actions (user creation, plugin installation, option changes) and alert on anomalies following link-click events

How to Mitigate CVE-2024-8874

Immediate Actions Required

Update the AJAX Login and Registration modal popup + inline form plugin to a version above 2.24 as soon as a patched release is available
Audit the plugin footprint on all WordPress installations and remove the plugin where it is not required
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Educate administrators to avoid clicking unverified links to their own WordPress sites

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Changeset Update for the applied fix and confirm the installed version is newer than 2.24.

Workarounds

Deploy a WAF rule that blocks requests containing script tags, event handlers, or javascript: schemes in query parameters directed at plugin URLs
Disable or deactivate the plugin until an updated version is installed and validated
Restrict access to WordPress login and registration pages using IP allow-listing where practical

bash

# Example WAF rule concept (ModSecurity) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1008874,phase:2,deny,status:403,log,\
    msg:'Reflected XSS attempt targeting CVE-2024-8874'"