CVE-2024-9347: WP Extended Plugin XSS Vulnerability

CVE-2024-9347 Overview

CVE-2024-9347 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Ultimate WordPress Toolkit – WP Extended plugin. The flaw exists in the wpext-export parameter and affects all versions up to and including 3.0.9. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The injected script executes when a targeted user clicks a crafted link. The fix was initially applied, reverted in version 3.0.11, and reapplied in version 3.0.13.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, credential theft, or administrative account compromise via social engineering.

Affected Products

WP Extended (Ultimate WordPress Toolkit) plugin versions up to and including 3.0.9
WP Extended plugin version 3.0.11 (regression reintroduced the vulnerability)
WP Extended plugin version 3.0.12

Discovery Timeline

2024-10-17 - CVE-2024-9347 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9347

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified as [CWE-79]. It resides in the plugin's export handler located at includes/libraries/wpext_export/wpext_export.php. The application accepts the wpext-export request parameter and reflects its value into the HTTP response without proper sanitization or escaping. An attacker can craft a URL containing malicious JavaScript in this parameter and trick an authenticated user into visiting it. Because the exploit requires no authentication on the attacker's side, any WordPress installation running a vulnerable version is exposed to targeted phishing campaigns. Successful exploitation runs script in the context of the victim's session, which can be leveraged to steal cookies, perform actions on behalf of administrators, or pivot to further compromise.

Root Cause

The root cause is missing input sanitization and missing output escaping around the wpext-export parameter. The plugin trusts user-supplied query input and returns it directly in rendered output. WordPress provides functions such as sanitize_text_field() for input and esc_html() or esc_attr() for output, none of which were applied to this parameter in the vulnerable versions. A regression in version 3.0.11 removed the original patch, reintroducing the flaw until version 3.0.13.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted link, typically via email, chat, or a malicious site, that targets the vulnerable endpoint with a JavaScript payload embedded in the wpext-export parameter. When the victim clicks the link while authenticated to the affected WordPress site, the payload executes in the browser under the site's origin. See the WordPress Plugin Code Review for the vulnerable source line and the Wordfence Vulnerability Report for additional context.

No verified public proof-of-concept code is available. The vulnerability manifests when the wpext-export query parameter is reflected into HTML output without escaping. Refer to the vendor commit for the exact remediation logic.

Detection Methods for CVE-2024-9347

Indicators of Compromise

HTTP requests containing script tags, event handlers, or JavaScript URI schemes in the wpext-export query parameter.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E, onerror=, or javascript: targeting endpoints served by the WP Extended plugin.
Referer headers pointing to unfamiliar external domains preceding requests to WordPress administrative pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the wpext-export parameter for HTML tags, JavaScript keywords, and encoded script fragments.
Enable Content Security Policy (CSP) reporting to capture inline script violations originating from the WordPress admin domain.
Correlate WordPress access logs with authenticated administrator sessions to identify anomalous URLs delivered via external referers.

Monitoring Recommendations

Monitor plugin inventory to identify WordPress sites running WP Extended versions 3.0.9, 3.0.11, and 3.0.12.
Track outbound network connections from browsers used by WordPress administrators to detect data exfiltration following XSS execution.
Alert on newly created administrator accounts or unexpected privilege changes that could indicate post-XSS abuse.

How to Mitigate CVE-2024-9347

Immediate Actions Required

Update the WP Extended plugin to version 3.0.13 or later, which contains the reapplied fix.
Audit administrator sessions and force password resets for any accounts that may have interacted with suspicious links.
Review recent plugin, theme, and user modifications in WordPress for signs of unauthorized activity.

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Commit Changeset that applied proper sanitization to the wpext-export parameter. Note that this patch was reverted in version 3.0.11 and reintroduced in version 3.0.13, so administrators must confirm they are running 3.0.13 or later rather than any 3.0.10 through 3.0.12 release.

Workarounds

Deactivate the WP Extended plugin until the site can be upgraded to version 3.0.13 or later.
Configure a WAF to block requests where the wpext-export parameter contains HTML or script content.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative pages to reduce XSS impact.

bash

# Example ModSecurity rule to block script content in the vulnerable parameter
SecRule ARGS:wpext-export "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1009347,phase:2,deny,status:403,log,msg:'CVE-2024-9347 WP Extended XSS attempt blocked'"