Advanced Access Manager Vulnerability– Restricted Content, Users & Roles, Enhanced Security and More – Reflected Cross-Site Scripting – CVE-2024-29127 | WordPress Plugin Vulnerability Report

Plugin Name: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More

Key Information:

  • Software Type: Plugin
  • Software Slug: advanced-access-manager
  • Software Status: Active
  • Software Author: vasyltech
  • Software Downloads: 5,341,354
  • Active Installs: 100,000
  • Last Updated: March 20, 2024
  • Patched Versions: 6.9.21
  • Affected Versions: <= 6.9.20

Vulnerability Details:

  • Name: Advanced Access Manager <= 6.9.20
  • Title: Reflected Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-29127
  • CVSS Score: 6.1
  • Publicly Published: March 20, 2024
  • Researcher: Rafie Muhammad - Patchstack
  • Description: The Advanced Access Manager plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) in all versions up to and including 6.9.20, caused by insufficient input sanitization and output escaping. This vulnerability could allow unauthenticated attackers to execute arbitrary web scripts on pages viewed by users, provided they can persuade a user to click on a malicious link.


The Advanced Access Manager plugin, a popular WordPress tool for managing access and enhancing security, has been identified as having a Reflected Cross-Site Scripting vulnerability in versions up to and including 6.9.20. This security issue has been effectively resolved in the newly released version 6.9.21.

Detailed Overview:

This vulnerability was discovered by Rafie Muhammad from Patchstack, who noted that the plugin failed to adequately sanitize user input and escape output, leading to a scenario where attackers could inject harmful scripts into web pages. These scripts could then be executed in the context of a user's session, potentially leading to compromised personal information or unauthorized actions performed on behalf of the user. The severity of this vulnerability, with a CVSS score of 6.1, underlines the necessity of immediate action by website administrators to prevent potential exploits.

Advice for Users:

  • Immediate Action: It is critical for users of the Advanced Access Manager plugin to update to version 6.9.21 promptly to protect their websites from potential XSS attacks.
  • Check for Signs of Vulnerability: Administrators should examine their websites for any unusual activity or signs of compromise, which may indicate exploitation of this vulnerability prior to updating.
  • Alternate Plugins: While the immediate concern has been addressed, users may consider evaluating other plugins that offer similar functionality as a precautionary measure against future vulnerabilities.
  • Stay Updated: Ensuring that all WordPress plugins, themes, and the core system are regularly updated is vital in maintaining the security and integrity of your website.


The rapid response by the Advanced Access Manager development team to address the Reflected Cross-Site Scripting vulnerability underscores the ongoing battle between maintaining functionality and ensuring security within the WordPress ecosystem. Users are urged to upgrade to version 6.9.21 or later to safeguard their installations against this and potentially other security risks.


Detailed Report: 

In the ever-evolving landscape of digital security, keeping your WordPress website safeguarded against vulnerabilities is not just a recommendation; it's a necessity. The recent discovery of a Reflected Cross-Site Scripting (XSS) vulnerability in the "Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More" plugin, identified as CVE-2024-29127, serves as a critical reminder of the persistent threats lurking in the digital shadows. This plugin, a cornerstone for many in managing access and bolstering security on WordPress sites, has been a reliable tool for over 100,000 installations. Yet, like any software, it's not immune to the cunning tactics of cyber adversaries.

About the Plugin:

"Advanced Access Manager," developed by vasyltech, is renowned for its comprehensive solutions in managing user roles, access levels, and enhanced security measures within WordPress environments. With more than 5 million downloads, its popularity is a testament to its utility and effectiveness. However, the responsibility that comes with widespread use also includes maintaining the highest security standards.

Vulnerability Insights:

CVE-2024-29127 exposes a significant flaw in versions up to 6.9.20 of the plugin, where inadequate input sanitization and output escaping could allow attackers to inject malicious scripts. This vulnerability, publicly disclosed on March 20, 2024, by Rafie Muhammad of Patchstack, could potentially enable unauthenticated attackers to manipulate web pages viewed by users into executing arbitrary scripts, provided they can lure users into clicking a malicious link.

Risks and Impacts:

The implications of such a vulnerability cannot be understated. Reflected XSS attacks pose a substantial risk to user data privacy and website integrity, potentially enabling attackers to hijack user sessions, deface websites, or redirect visitors to malicious sites. For small business owners, the repercussions extend beyond mere technical glitches; they could erode customer trust, damage reputational equity, and even lead to regulatory scrutiny.

Remediation Steps:

In response to this threat, an update to the plugin, version 6.9.21, has been released, effectively patching the vulnerability. Users of the plugin are urged to update immediately to safeguard their sites. It's imperative for website administrators to stay vigilant, routinely checking for and applying updates to all WordPress components, including plugins and themes.

Historical Context:

It's worth noting that this is not the plugin's first encounter with security vulnerabilities; there have been 10 documented instances since August 20, 2014. This history highlights the ongoing battle between developers and threat actors, emphasizing the need for continuous monitoring and updating.


The swift resolution of CVE-2024-29127 by the Advanced Access Manager team exemplifies the critical role of proactive security practices in the digital realm. For small business owners, the challenge of keeping up with security updates amidst myriad operational demands is real. Yet, the cost of neglect could be far greater, potentially jeopardizing not just digital assets but the very essence of trust that binds customers to businesses. Leveraging automated update features, employing reputable security solutions, and fostering a culture of security awareness are indispensable strategies in fortifying your digital presence against the ceaseless tide of cyber threats.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Advanced Access Manager Vulnerability– Restricted Content, Users & Roles, Enhanced Security and More – Reflected Cross-Site Scripting – CVE-2024-29127 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment