CVE-2024-8486 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-8486?

CVE-2024-8486 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with Contributor-level access or higher to inject malicious JavaScript into website pages via the Modern Heading and Icon Picker widgets. The injected scripts execute whenever users view the compromised pages, enabling session hijacking, defacement, or malware distribution. All WordPress sites using the Phlox theme's Shortcodes and extra features plugin up to version 2.16.3 are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress users with Contributor-level access or higher to inject malicious JavaScript into website pages via the Modern Heading and Icon Picker widgets. The injected scripts execute whenever users view the compromised pages, enabling session hijacking, defacement, or malware distribution. All WordPress sites using the Phlox theme's Shortcodes and extra features plugin up to version 2.16.3 are affected.

💻 Affected Systems

Products:

Phlox theme Shortcodes and extra features plugin for WordPress

Versions: All versions up to and including 2.16.3

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with the vulnerable plugin installed and at least one Contributor-level user account.

📦 What is this software?

Shortcodes And Extra Features For Phlox Theme by Averta

View all CVEs affecting Shortcodes And Extra Features For Phlox Theme →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, redirect users to malicious sites, install backdoors, or completely compromise the WordPress site and potentially the server.

🟠

Likely Case

Site defacement, cookie/session theft leading to account takeover, or redirection to phishing/malware sites affecting visitors.

🟢

If Mitigated

Limited to authenticated users only, reducing exposure but still allowing privilege escalation from Contributor to higher roles.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is trivial once authenticated. Public proof-of-concept exists in the WordPress patch commit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.16.4

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3161415/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Phlox theme Shortcodes and extra features'. 4. Click 'Update Now' if available, or manually update to version 2.16.4+. 5. Clear any caching plugins/CDN caches.

🔧 Temporary Workarounds

Remove vulnerable widgets

all

Disable or remove the Modern Heading and Icon Picker widgets from Elementor if patching isn't immediately possible.

Restrict user roles

all

Temporarily remove Contributor-level access or limit who can create/edit posts.

🧯 If You Can't Patch

Implement a Web Application Firewall (WAF) with XSS protection rules
Disable the entire auxin-elements plugin until patching is possible

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Phlox theme Shortcodes and extra features' version 2.16.3 or lower.

Check Version:

wp plugin list --name='auxin-elements' --field=version

Verify Fix Applied:

Confirm plugin version is 2.16.4 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with 'url' parameter containing script tags
Multiple page edits by Contributor users

Network Indicators:

Outbound connections to suspicious domains from your WordPress site
Unexpected JavaScript loading from your domain

SIEM Query:

source="wordpress.log" AND ("auxin-elements" OR "heading-modern" OR "icon.php") AND ("url=" OR "script" OR "onerror")

📊 Metadata

CVE ID: CVE-2024-8486

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: October 5, 2024

Last Updated: May 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8486, you might also want to check these: