CVE-2024-9667: Seriously Simple Podcasting XSS Vulnerability

CVE-2024-9667 Overview

CVE-2024-9667 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Seriously Simple Podcasting plugin for WordPress developed by Castos. The flaw exists in all versions up to and including 3.5.0. It stems from the use of the add_query_arg function without appropriate escaping on the URL within the plugin's options handler. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Successful exploitation can lead to session theft, redirection, or actions performed in the context of an authenticated user.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session by tricking an administrator into clicking a malicious link, potentially leading to account takeover on affected WordPress sites.

Affected Products

Castos Seriously Simple Podcasting plugin for WordPress — all versions through 3.5.0
WordPress sites with the plugin installed and active
Administrator sessions accessing the plugin's options pages

Discovery Timeline

2024-11-05 - CVE-2024-9667 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-9667

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw categorized under [CWE-79]. It resides in the plugin's options handler at php/classes/handlers/class-options-handler.php, where the add_query_arg WordPress function is invoked without proper escaping of the current request URL. When WordPress's add_query_arg receives no explicit URL argument, it defaults to using the current request URI, which an attacker can control via query parameters. Because the returned URL is later rendered in HTML without sanitization, attacker-controlled content executes in the victim's browser under the site's origin.

Root Cause

The root cause is missing output escaping around the result of add_query_arg. WordPress documentation explicitly warns that the return value must be escaped with esc_url() before being placed in HTML attributes, since it may reflect untrusted request data. The plugin's options handler emitted the value into administrative pages without applying esc_url() or equivalent sanitization, enabling injection of arbitrary script content.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to an administrative page of a vulnerable WordPress site with malicious payload data appended as query parameters. When an authenticated user, typically an administrator, clicks the link, the reflected payload executes in their browser. This can be used to exfiltrate cookies, submit forged requests, create rogue admin accounts, or plant persistent backdoors through the plugin's editing interfaces.

// No verified public exploit code is available for this CVE.
// Refer to the WordPress plugin code review for technical details:
// https://plugins.trac.wordpress.org/browser/seriously-simple-podcasting/trunk/php/classes/handlers/class-options-handler.php#L101

See the WordPress Plugin Code Review for the exact vulnerable line, and the Wordfence Vulnerability Analysis for third-party technical breakdown.

Detection Methods for CVE-2024-9667

Indicators of Compromise

Web server access logs showing requests to plugin administrative pages with unusual query strings containing HTML tags, JavaScript keywords, or URL-encoded <script> payloads.
Outbound HTTP requests from administrator browsers to unknown domains shortly after clicking external links referencing WordPress admin URLs.
Creation of new administrator accounts or modification of user roles that do not correspond to legitimate administrative activity.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query parameters targeting /wp-admin/ paths for reflected XSS payloads such as <script>, onerror=, or javascript: schemes.
Correlate referrer headers and query strings against known plugin URLs to identify attempted parameter injection.
Review WordPress audit logs for unexpected changes to plugin settings or user accounts following admin activity.

Monitoring Recommendations

Enable verbose logging on the WordPress admin surface and forward logs to a centralized analytics platform for query-string anomaly detection.
Monitor DOM-level browser telemetry on admin workstations for script injection events originating from WordPress admin domains.
Track plugin version inventory across managed sites to identify hosts still running Seriously Simple Podcasting 3.5.0 or earlier.

How to Mitigate CVE-2024-9667

Immediate Actions Required

Update the Seriously Simple Podcasting plugin to the version released after changeset 3181485, which addresses this vulnerability.
Audit administrator accounts for unexpected additions or privilege changes and reset credentials where suspicious activity is observed.
Instruct administrators to avoid clicking links to WordPress admin URLs received from untrusted sources until patching is complete.

Patch Information

Castos addressed the vulnerability by adding proper URL escaping around the add_query_arg output in the options handler. Details are available in the WordPress Changeset 3181485. Site operators should upgrade to the fixed release available from the plugin's WordPress.org listing on the Seriously Simple Podcasting Developer Info page.

Workarounds

Deactivate and remove the Seriously Simple Podcasting plugin until an upgrade to a patched version can be completed.
Deploy a WAF rule that blocks requests to plugin admin endpoints containing script tags or event handler attributes in query parameters.
Restrict WordPress admin access by IP allowlist to reduce the attack surface for reflected XSS delivery.

bash

# Example WordPress CLI upgrade command
wp plugin update seriously-simple-podcasting
wp plugin get seriously-simple-podcasting --field=version