Executive brief
WP24 Domain Check is a WordPress plugin that allows website visitors to check if domain names are available for registration. A security flaw in the plugin's settings allows an attacker with low-level account access to inject malicious scripts into the website's administrative dashboard. If an administrator views the affected settings page, the script could execute, potentially leading to unauthorized actions or the theft of sensitive administrative session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in WP24 Domain Check versions 1.6.2 and earlier. The vulnerability is located in the 'fieldnameDomain' parameter within the plugin's advanced settings. An authenticated attacker with sufficient privileges to modify plugin settings (or by exploiting a lack of authorization checks on the options.php endpoint) can submit a crafted payload that is stored in the database. When an administrator subsequently views the plugin settings page, the malicious JavaScript executes in their browser context. This can be used to hijack administrative sessions or perform unauthorized configuration changes. The issue was addressed in version 1.6.3.
Affected products
- WP24 WP24 Domain Check <= 1.6.2
Timeline
- 2021-01-03: disclosed: Vulnerability discovered by researcher
- 2021-01-06: other: Exploit published on Exploit-DB
- 2026-06-08: advisory: CVE published to NVD