CVE-2024-8914 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-8914?

CVE-2024-8914 has a CVSS score of 7.2 (HIGH). This vulnerability allows unauthenticated attackers to inject malicious JavaScript into WordPress pages using the Thanh Toán Quét Mã QR Code Tự Động plugin. When users visit compromised pages, the injected scripts execute in their browsers, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the user. All WordPress sites using this plugin up to version 2.0.1 are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to inject malicious JavaScript into WordPress pages using the Thanh Toán Quét Mã QR Code Tự Động plugin. When users visit compromised pages, the injected scripts execute in their browsers, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the user. All WordPress sites using this plugin up to version 2.0.1 are affected.

💻 Affected Systems

Products:

Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam WordPress plugin

Versions: All versions up to and including 2.0.1

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: The vulnerability exists in the plugin's wp_kses_allowed_html function usage, allowing 'onclick' attributes without proper validation.

📦 What is this software?

Thanh Toan Quet Ma Qr Code Tu Dong by Wordpress

View all CVEs affecting Thanh Toan Quet Ma Qr Code Tu Dong →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator session cookies, take over the WordPress site, install backdoors, deface the site, or redirect users to phishing/malware sites.

🟠

Likely Case

Attackers inject malicious scripts that steal user session cookies, redirect to phishing pages, or display unwanted advertisements.

🟢

If Mitigated

With proper input validation and output escaping, the vulnerability would be prevented, though users should still update to patched versions.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is straightforward to exploit as it requires no authentication and involves simple script injection.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 2.0.1

Vendor Advisory: https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Thanh Toán Quét Mã QR Code Tự Động' plugin. 4. Click 'Update Now' if available, or delete and reinstall latest version. 5. Verify plugin version is above 2.0.1.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the plugin until patched version is available

wp plugin deactivate bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang

Apply WordPress security plugin

all

Install security plugins like Wordfence that can block XSS attacks

🧯 If You Can't Patch

Disable the plugin completely if patching is not possible
Implement web application firewall (WAF) rules to block XSS payloads targeting this plugin

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Thanh Toán Quét Mã QR Code Tự Động' plugin version 2.0.1 or lower

Check Version:

wp plugin get bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang --field=version

Verify Fix Applied:

Verify plugin version is above 2.0.1 in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to plugin endpoints with script tags or onclick attributes
Multiple failed XSS attempts in web server logs

Network Indicators:

HTTP requests containing malicious script payloads targeting plugin endpoints

SIEM Query:

source="web_server" AND ("onclick" OR "javascript:" OR "<script>") AND uri_path="/wp-content/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/"

📊 Metadata

CVE ID: CVE-2024-8914

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: September 25, 2024

Last Updated: December 31, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8914, you might also want to check these: