CVE-2024-9436: WordPress PublishPress Revisions XSS Flaw

CVE-2024-9436 Overview

CVE-2024-9436 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the PublishPress Revisions WordPress plugin. The flaw affects all versions up to and including 3.5.14. It stems from unsafe use of add_query_arg() without proper output escaping on URLs rendered by the plugin's admin list tables. Unauthenticated attackers can craft malicious links that inject arbitrary JavaScript into pages when a logged-in user clicks the link. Successful exploitation executes attacker-controlled script in the victim's browser session, enabling session theft, forced administrative actions, or content manipulation.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in an authenticated user's browser through a crafted URL, potentially leading to account takeover of WordPress administrators.

Affected Products

• PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress
• All versions up to and including 3.5.14
• WordPress sites with the Revisionary plugin installed and activated

Discovery Timeline

• 2024-10-11 - CVE-2024-9436 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9436

Vulnerability Analysis

The vulnerability resides in the plugin's admin list table components, specifically admin/class-list-table-archive.php and admin/class-list-table_rvy.php. Both files construct URLs using WordPress's add_query_arg() function without escaping the resulting output. When user-controlled query parameters from the current request URL are echoed back into rendered HTML, attacker-supplied JavaScript executes in the browser context.

The attack requires user interaction. A victim must click a crafted link while authenticated to a WordPress site running a vulnerable version. Because the script runs in the context of the authenticated user, an attacker targeting an administrator can perform any action the administrator can perform.

Root Cause

WordPress's add_query_arg() function returns a URL derived from the current request URI when no explicit URL argument is provided. The returned value contains unsanitized query string data. The Revisionary plugin passes this return value directly into HTML output without wrapping it in esc_url() or an equivalent escaping function. This missing output encoding allows reflected input to break out of the URL context and inject <script> payloads or event handlers into rendered pages.

Attack Vector

Exploitation requires an unauthenticated attacker to craft a URL containing a malicious query string that targets the vulnerable admin pages. The attacker then delivers this URL through phishing, social engineering, or embedding it in third-party content. When an authenticated WordPress user, typically an editor or administrator, clicks the link, the injected script executes within the WordPress admin session. See the Wordfence Vulnerability Report and the Revisionary changeset for the fix details.

Detection Methods for CVE-2024-9436

Indicators of Compromise

• Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains following WordPress admin activity
• Access log entries containing script tags, javascript: URIs, or encoded payloads in query strings targeting /wp-admin/ paths related to the Revisionary plugin
• New or modified administrator accounts, plugins, or theme files without a corresponding legitimate change ticket
• Referrer headers pointing to external phishing or link-shortener domains preceding suspicious admin actions

Detection Strategies

• Inventory WordPress installations and identify sites running the Revisionary plugin at version 3.5.14 or earlier
• Inspect web server access logs for GET requests to Revisionary admin endpoints containing suspicious query parameters such as %3Cscript%3E, onerror=, or onmouseover=
• Deploy a Web Application Firewall (WAF) rule that blocks reflected script patterns in query strings targeting the WordPress admin interface

Monitoring Recommendations

• Alert on administrator sessions performing unusual bulk actions on posts, users, or plugins shortly after clicking external links
• Monitor for changes to WordPress wp_users, wp_options, and plugin files that occur outside change windows
• Correlate email gateway telemetry with WordPress admin activity to identify phishing campaigns targeting editorial staff

How to Mitigate CVE-2024-9436

Immediate Actions Required

• Update the PublishPress Revisions plugin to a version later than 3.5.14 on all WordPress installations
• Force password resets and invalidate active sessions for administrator and editor accounts on sites that ran vulnerable versions
• Review recent plugin, theme, and user account changes for unauthorized modifications
• Educate editorial and administrative staff about the risk of clicking untrusted links while logged into WordPress

Patch Information

The issue was addressed in changeset 3165210 in the plugin's source repository. Site administrators should upgrade to the latest available release of PublishPress Revisions through the WordPress plugin dashboard or by deploying the updated package. Review the Revisionary changeset and the affected files class-list-table-archive.php and class-list-table_rvy.php for the specific code paths corrected by the patch.

Workarounds

• Deactivate the Revisionary plugin until the patched version can be deployed if immediate upgrade is not possible
• Restrict access to /wp-admin/ through IP allow-listing at the web server or WAF layer
• Deploy a Content Security Policy (CSP) that disallows inline script execution in the WordPress admin interface to blunt reflected XSS payloads
• Require administrators to use a dedicated browser profile for WordPress management to reduce the impact of clickjacked links

# Example WAF rule concept for blocking common reflected XSS payloads in query strings
# (Adapt to your WAF syntax: ModSecurity, AWS WAF, Cloudflare, etc.)
SecRule REQUEST_URI "@rx (?i)(<script|javascript:|onerror=|onload=|onmouseover=)" \
  "id:1009436,phase:1,deny,status:403,msg:'Reflected XSS attempt against WordPress admin (CVE-2024-9436)'"