CVE-2024-9204: Smart Custom 404 Error Page XSS Vulnerability

CVE-2024-9204 Overview

The Smart Custom 404 Error Page plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 11.4.7. The flaw stems from insufficient input sanitization and output escaping of the $_SERVER['REQUEST_URI'] variable. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The plugin is distributed by Nerdpress and used on WordPress sites to render customized 404 error pages.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover through social engineering.

Affected Products

Nerdpress Smart Custom 404 Error Page plugin for WordPress (all versions ≤ 11.4.7)
WordPress sites with the 404page plugin enabled
Any site rendering the plugin's custom 404 template on user-supplied paths

Discovery Timeline

2024-10-04 - CVE-2024-9204 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9204

Vulnerability Analysis

The vulnerability resides in how the Smart Custom 404 Error Page plugin processes the requested URI when rendering a custom 404 page. The plugin reads $_SERVER['REQUEST_URI'] and reflects the value into the response HTML without proper sanitization or context-aware output escaping. Because WordPress routes unmatched paths through the plugin's 404 handler, an attacker can craft a URL that includes JavaScript payloads in the path or query string. When a victim follows the crafted link, the payload executes in the victim's browser under the origin of the vulnerable site. This scoped, cross-context execution enables session hijacking, forced administrative actions via authenticated victims, and phishing overlays. The plugin author addressed the issue in changeset 3161639, adding proper escaping before the value is emitted into the response.

Root Cause

The root cause is missing output encoding when concatenating the request URI into the 404 page markup. The plugin's helper function in functions.php and the class method in inc/class-404page.php pass attacker-controlled data directly to HTML output. WordPress functions such as esc_url() or esc_html() were not applied to the reflected value, violating standard WordPress plugin security guidance for handling superglobals. See the WordPress 404page Class Code for the pre-patch implementation.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing at any non-existent path on the vulnerable WordPress site, embedding a JavaScript payload in the path segment. The attacker distributes the link through email, chat, malicious ads, or social platforms. When a victim opens the link, the plugin renders the 404 template and reflects the malicious path into the DOM, causing the browser to execute the injected script in the site's origin. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-9204

Indicators of Compromise

HTTP requests to the WordPress site containing URL-encoded <script>, onerror=, javascript:, or %3Cscript%3E sequences in the path or query string.
404 responses served by the 404page plugin where the response body reflects unescaped user-supplied path segments.
Referrer headers from unfamiliar external domains preceding suspicious 404 requests.

Detection Strategies

Inspect web server access logs for requests targeting non-existent paths that contain HTML or JavaScript metacharacters.
Deploy a Web Application Firewall (WAF) rule that blocks common XSS payload patterns in the request URI targeting WordPress installations.
Compare installed plugin versions against the fixed release; flag any deployment of 404page at version 11.4.7 or earlier.

Monitoring Recommendations

Alert on anomalous spikes in 404 responses correlated with suspicious query strings or referrers.
Monitor administrator sessions for unexpected privilege changes, plugin installations, or user-role modifications following user visits to crafted links.
Ingest WordPress and web server logs into a centralized analytics platform to correlate reflected-XSS indicators with downstream account activity.

How to Mitigate CVE-2024-9204

Immediate Actions Required

Update the Smart Custom 404 Error Page (404page) plugin to a version later than 11.4.7 that contains changeset 3161639.
Audit administrative accounts and rotate credentials for any user who may have followed suspicious links to the site.
Enable a Content Security Policy (CSP) that restricts inline script execution to reduce the impact of reflected XSS.

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository via WordPress Changeset #3161639. The patch applies proper output escaping to the reflected $_SERVER['REQUEST_URI'] value before it is rendered on the custom 404 page. Site administrators should upgrade through the WordPress plugin management console or via WP-CLI.

Workarounds

Temporarily deactivate the 404page plugin until the patched version is installed, allowing WordPress to serve its default 404 template.
Deploy WAF rules that strip or block HTML metacharacters in request URIs sent to the vulnerable endpoint.
Enforce a strict CSP header disallowing unsafe-inline scripts to reduce browser-side execution of reflected payloads.

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update 404page

# Verify the installed version is greater than 11.4.7
wp plugin get 404page --field=version

# If no patched version is yet available, deactivate the plugin
wp plugin deactivate 404page