CVE-2024-9226: Landing Page Cat WordPress Plugin XSS Flaw

CVE-2024-9226 Overview

CVE-2024-9226 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress. The flaw affects all versions up to and including 1.7.6. It stems from the use of the add_query_arg function without proper URL escaping. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The plugin is widely deployed on WordPress sites that use it for coming-soon and maintenance landing pages, expanding the attack surface for phishing and session-hijacking campaigns.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and administrative account takeover on affected WordPress sites.

Affected Products

Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress
All versions up to and including 1.7.6
WordPress sites running the vulnerable plugin with administrators or authenticated users who can be socially engineered

Discovery Timeline

2024-11-09 - CVE-2024-9226 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9226

Vulnerability Analysis

The vulnerability resides in the plugin's use of WordPress's add_query_arg function within includes/subscribers.php. The function returns a URL constructed from the current request context, including untrusted query parameters. When the plugin echoes this URL back into HTML output without applying esc_url or equivalent escaping, attacker-controlled input is rendered directly into the page. An attacker crafts a URL that appends malicious query parameters and delivers it to a target through phishing or a malicious link. When the target visits the URL, the browser executes the injected JavaScript in the context of the vulnerable WordPress site.

Root Cause

The root cause is missing output encoding on a URL generated by add_query_arg. WordPress documentation explicitly warns that add_query_arg reflects untrusted $_SERVER and $_GET data. Developers must wrap its return value in esc_url or esc_url_raw before rendering it into HTML attributes. The plugin failed to apply this escaping, producing a Reflected XSS sink. Reference: WordPress Plugin Code Reference.

Attack Vector

Exploitation requires user interaction. An attacker constructs a URL pointing to a page on the target WordPress site that reflects the unescaped add_query_arg output. Injected payloads terminate the surrounding HTML attribute and introduce a script context. When a logged-in administrator clicks the link, the payload runs with the administrator's cookies and DOM access, enabling account takeover, arbitrary post creation, or plugin installation. See the Wordfence Vulnerability Report for additional context.

No verified public exploit code is available. The vulnerability mechanism is described in prose per source-grounding requirements.

Detection Methods for CVE-2024-9226

Indicators of Compromise

Web server access logs containing requests to Landing Page Cat plugin endpoints with query strings that include <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript
Referer headers originating from external phishing domains that link to plugin pages
Unexpected administrator account creation, plugin installation, or theme modification events following administrator sessions that visited crafted URLs

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that blocks script-like payloads in query parameters on WordPress request paths handled by the plugin
Correlate outbound requests from administrator browsers to unfamiliar domains immediately after visits to WordPress admin URLs, indicating potential data exfiltration from an XSS payload
Monitor WordPress audit logs for privilege changes, option modifications, and new administrative users occurring during known administrator session windows

Monitoring Recommendations

Enable verbose logging on the WordPress wp-admin and plugin endpoints and forward logs to a central SIEM for correlation
Alert on HTTP responses that reflect query-string content matching common XSS patterns
Track plugin version inventory across managed WordPress installations to identify hosts still running versions at or below 1.7.6

How to Mitigate CVE-2024-9226

Immediate Actions Required

Update the Landing Page Cat plugin to the latest patched version available in the WordPress plugin repository
If an update is not immediately possible, deactivate and remove the plugin until a fix is applied
Force password resets and review recent administrative activity for any WordPress site where administrators may have clicked untrusted links
Deploy WAF signatures that block reflected XSS payloads in query parameters targeting plugin URLs

Patch Information

The plugin author released a fix documented in the WordPress Plugin Changeset Update. Site operators should upgrade beyond version 1.7.6 and confirm the update via the WordPress admin dashboard. Details are also mirrored in the Wordfence Vulnerability Report.

Workarounds

Restrict administrative access to trusted IP addresses using server-level allowlists or a WAF policy
Enforce browser-level defenses such as a strict Content-Security-Policy (CSP) header that disallows inline scripts and untrusted script sources
Train administrators to avoid clicking unsolicited links referencing their WordPress site and to authenticate to wp-admin only from bookmarked URLs

bash

# Example nginx configuration to add a Content-Security-Policy header
# and block obvious XSS patterns in query strings on WordPress endpoints
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;

if ($query_string ~* "(<|%3C)script|javascript:|onerror=|onload=") {
    return 403;
}