CVE-2024-8914: WordPress QR Payment Plugin XSS Vulnerability

CVE-2024-8914 Overview

CVE-2024-8914 is a Stored Cross-Site Scripting (XSS) vulnerability in the Thanh Toán Quét Mã QR Code Tự Động WordPress plugin. The plugin supports Vietnamese payment providers including MoMo, ViettelPay, VNPay, and 40 Vietnamese banks. All versions up to and including 2.0.1 are affected.

The flaw stems from improper use of the wp_kses_allowed_html function, which permits the onclick attribute on certain HTML elements without adequate context validation. Unauthenticated attackers can inject arbitrary JavaScript that executes when users access affected pages [CWE-79].

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, credential harvesting, and administrative account takeover on affected WordPress sites.

Affected Products

WordPress plugin: Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam
Plugin slug: bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang
All versions up to and including 2.0.1

Discovery Timeline

2024-09-25 - CVE-2024-8914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8914

Vulnerability Analysis

The vulnerability resides in the plugin's HTML sanitization logic within inc/functions.php. The plugin invokes wp_kses_allowed_html with a custom allowlist that includes the onclick event handler attribute on permitted HTML elements. WordPress's wp_kses function relies on the allowlist to determine which tags and attributes survive sanitization.

Because onclick is permitted, attacker-supplied input retains JavaScript event handlers after sanitization. The injected payload persists in the WordPress database and renders on pages served to site visitors. The Exploit Prediction Scoring System (EPSS) places this vulnerability in the 23rd percentile of exploitability.

Root Cause

The root cause is an over-permissive HTML allowlist passed to wp_kses_allowed_html. Allowing event handler attributes such as onclick defeats the purpose of HTML sanitization. Standard WordPress sanitization practice excludes all on* event handlers from user-supplied content.

The plugin's developers extended the allowlist without validating attribute values or restricting the contexts in which scripted attributes appear. The fix, applied in changeset 3349149, tightens the attribute allowlist.

Attack Vector

An unauthenticated remote attacker submits crafted input containing HTML elements with malicious onclick handlers. The plugin stores the payload through its standard input flow. When any user, including administrators, visits the page that renders the stored content, the JavaScript executes in their browser session.

Exploitation requires no authentication and no user interaction beyond visiting a page containing the payload. Successful exploitation enables cookie theft, session hijacking, defacement, and pivoting to administrative privilege escalation.

Detection Methods for CVE-2024-8914

Indicators of Compromise

Database entries in plugin tables or wp_posts containing HTML attributes such as onclick, onmouseover, or onerror with JavaScript payloads.
Unexpected outbound requests from visitor browsers to attacker-controlled domains following page loads.
New or modified WordPress administrator accounts created shortly after suspicious page views.
Web access logs showing repeated POST requests to plugin endpoints from a single source with HTML or script content in parameters.

Detection Strategies

Query the WordPress database for stored content matching the regular expression on[a-z]+\s*= within plugin-managed fields.
Inspect rendered HTML output of plugin-controlled pages for inline event handlers using automated DOM scanners.
Compare installed plugin version against the patched release referenced in WordPress Changeset 3349149.
Review the Wordfence Vulnerability Report for additional signatures.

Monitoring Recommendations

Enable WordPress activity logging to capture content modifications by unauthenticated requests.
Deploy a Content Security Policy (CSP) that blocks inline event handlers and report violations to a monitoring endpoint.
Alert on HTTP requests to plugin endpoints containing URL-encoded HTML tags or javascript: schemes.

How to Mitigate CVE-2024-8914

Immediate Actions Required

Update the Thanh Toán Quét Mã QR Code Tự Động plugin to a version newer than 2.0.1 that includes the fix from changeset 3349149.
Audit existing plugin-managed content for stored on* event handler attributes and remove malicious entries.
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected.
Review WordPress user accounts for unauthorized administrative additions.

Patch Information

The vendor addressed the issue in WordPress Changeset 3349149, which corrects the wp_kses_allowed_html configuration in inc/functions.php. Site administrators should install the latest version from the official plugin page.

Workarounds

Deactivate the plugin until patching is feasible.
Apply a Web Application Firewall (WAF) rule blocking requests to plugin endpoints containing on[a-z]+= attribute patterns.
Enforce a strict Content Security Policy that disallows inline scripts and event handlers across the WordPress site.

bash

# Example CSP header for nginx to block inline event handlers
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'";