Advanced Cron Manager Vulnerability – debug & control – Authenticated (Admin+) Stored Cross-Site Scripting – CVE-2024-31926 | WordPress Plugin Vulnerability Report

Plugin Name: Advanced Cron Manager – debug & control

Key Information:

  • Software Type: Plugin
  • Software Slug: advanced-cron-manager
  • Software Status: Active
  • Software Author: kubitomakita
  • Software Downloads: 573,600
  • Active Installs: 30,000
  • Last Updated: April 25, 2024
  • Patched Versions: 2.5.3
  • Affected Versions: <= 2.5.2

Vulnerability Details:

  • Name: Advanced Cron Manager – debug & control <= 2.5.2
  • Title: Authenticated (Admin+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-31926
  • CVSS Score: 4.4
  • Publicly Published: April 10, 2024
  • Researcher: emad
  • Description: The Advanced Cron Manager plugin for WordPress, used for debugging and controlling cron jobs, has a Stored Cross-Site Scripting vulnerability in versions up to and including 2.5.2. This issue arises due to inadequate input sanitization and output escaping within admin settings, enabling attackers with administrator-level access to inject harmful web scripts. These scripts can execute on any page accessed by a user, particularly affecting multi-site installations or those where unfiltered_html capability has been disabled.


The Advanced Cron Manager plugin for WordPress has a vulnerability in versions up to and including 2.5.2 that allows authenticated users with admin-level permissions to perform stored cross-site scripting (XSS) attacks. This vulnerability has been addressed in version 2.5.3.

Detailed Overview:

The vulnerability, discovered by security researcher emad, specifically affects installations where either multi-site features are utilized or unfiltered_html is disabled. By exploiting the insufficient input sanitization and output escaping mechanisms in the plugin's admin settings, attackers can inject and store malicious scripts in the database. These scripts then execute whenever a user accesses a compromised page, leading to potential data leakage or unauthorized actions being performed under the guise of the user's session. The remediation was swiftly implemented in the update to version 2.5.3, which corrects the sanitization and escaping flaws.

Advice for Users:

  • Immediate Action: Update to version 2.5.3 without delay to mitigate this vulnerability.
  • Check for Signs of Vulnerability: Admins should review their site's pages and settings for any unusual or unauthorized script insertions, especially if running versions earlier than 2.5.3.
  • Alternate Plugins: Consider exploring other cron job management plugins that offer robust security features as a preventive measure.
  • Stay Updated: Consistently keep your WordPress plugins updated to the most current versions to safeguard against known vulnerabilities.


The swift action taken by the developers of the Advanced Cron Manager to release a patched version (2.5.3) highlights the critical nature of maintaining security through regular updates. As WordPress site administrators, it is paramount to install these updates promptly to protect your sites from potential security threats.


Detailed Report: 

In the digital age, where technology rapidly evolves, so does the landscape of cybersecurity threats. The recent discovery of a significant security flaw in the "Advanced Cron Manager – debug & control" plugin for WordPress highlights an ongoing challenge: keeping digital platforms secure against emerging threats. This plugin, critical for scheduling and managing tasks on WordPress sites, has been found vulnerable to a severe form of attack, affecting over 30,000 websites.

Risks and Potential Impacts:

The Stored Cross-Site Scripting (XSS) vulnerability presents numerous risks, primarily allowing unauthorized script injection that can manipulate or steal data, deface websites, or hijack user sessions. For businesses, this could mean breaches of confidential information, loss of customer trust, and potential legal implications, particularly if personal data of users are compromised.

Steps to Remediate the Vulnerability:

  1. Immediate Action: Update the plugin to the patched version 2.5.3 immediately to close the security loophole.
  2. Audit Your Site: Check your website’s pages and settings for any unusual or unauthorized script insertions, particularly if you are running older versions.
  3. Regular Maintenance: Continue to update all WordPress plugins and themes regularly. Consider setting up automatic updates where possible to ensure timely application.

Historical Context:

This is not the first time vulnerabilities have been reported in this plugin; there has been one previous incident since January 4, 2022. This pattern underscores the need for ongoing vigilance and proactive security practices.


For small business owners, maintaining a secure online presence must be a priority, albeit a challenging one amidst numerous responsibilities. However, neglecting this aspect can result in dire consequences. Ensuring that plugins like Advanced Cron Manager are kept up to date is not just beneficial; it's imperative for safeguarding your digital assets against sophisticated cyber threats. As we've seen, the developers are quick to respond with patches, and staying current with these updates is the simplest yet most effective defense strategy against potential exploits.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Advanced Cron Manager Vulnerability – debug & control – Authenticated (Admin+) Stored Cross-Site Scripting – CVE-2024-31926 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment