Page scroll to id – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1445 |WordPress Plugin Vulnerability Report

Plugin Name: Page scroll to id

Key Information:

  • Software Type: Plugin
  • Software Slug: page-scroll-to-id
  • Software Status: Active
  • Software Author: malihu
  • Software Downloads: 1,684,219
  • Active Installs: 100,000
  • Last Updated: February 27, 2024
  • Patched Versions: 1.7.9
  • Affected Versions: <= 1.7.8

Vulnerability Details:

  • Name: Page scroll to id <= 1.7.8
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1445
  • CVSS Score: 6.4
  • Publicly Published: February 16, 2024
  • Researcher: Richard Telleng (stueotue)
  • Description: The "Page scroll to id" plugin for WordPress contains a vulnerability in versions up to and including 1.7.8 that allows authenticated attackers with contributor-level access or higher to execute stored cross-site scripting (XSS) attacks through the plugin's shortcodes. The vulnerability stems from insufficient input sanitization and output escaping, enabling the injection of arbitrary web scripts that execute whenever an affected page is accessed.


The "Page scroll to id" plugin, a widely used tool for creating smooth scrolling effects in WordPress sites, has been identified to have a critical vulnerability in its shortcode handling mechanism. This flaw, present in versions up to 1.7.8, has been effectively patched in the latest version, 1.7.9.

Detailed Overview:

This vulnerability was uncovered by security researcher Richard Telleng, who noted the potential for authenticated users with at least contributor permissions to inject malicious scripts via the plugin's shortcode attributes. Such vulnerabilities pose significant risks, including unauthorized access to user data, session hijacking, and the compromise of website integrity. The prompt release of version 1.7.9 by the plugin's developers mitigates these risks by ensuring proper input sanitization and output escaping.

Advice for Users:

  • Immediate Action: Users of the "Page scroll to id" plugin should immediately update to version 1.7.9 to safeguard their sites against this vulnerability.
  • Check for Signs of Vulnerability: Site administrators should audit their web pages for unexpected or suspicious scripts, particularly in sections where shortcodes are utilized, as these could indicate exploitation attempts.
  • Alternate Plugins: While the patched version addresses this specific vulnerability, users may consider alternative plugins that offer similar functionality, especially if they seek additional features or enhanced security.
  • Stay Updated: It is crucial for all WordPress users to regularly update their plugins, themes, and core software to the latest versions to protect against known vulnerabilities and ensure optimal site performance and security.


The discovery and subsequent patching of CVE-2024-1445 in the "Page scroll to id" plugin underscore the ongoing importance of cybersecurity vigilance within the WordPress ecosystem. Users are encouraged to promptly apply updates and adhere to best security practices, ensuring their websites remain secure and functional. For small business owners, understanding and addressing such vulnerabilities is essential, not only for the security of their digital assets but also for maintaining the trust and confidence of their customers.


In the digital tapestry of today's online presence, WordPress stands out as a beacon for many websites, especially for small business owners who rely on its versatility and user-friendly interface. Within this ecosystem, plugins like "Page scroll to id" enhance user experience through smooth navigation and scrolling effects. However, the discovery of the CVE-2024-1445 vulnerability within this popular plugin underscores a critical challenge: the delicate balance between functionality and security. This vulnerability highlights the necessity of vigilance and timely updates to safeguard digital assets against potential threats.

Plugin Overview:

"Page scroll to id" is a widely utilized WordPress plugin developed by malihu, boasting over 1.6 million downloads and 100,000 active installations. It provides an elegant solution for implementing smooth scrolling effects on WordPress sites, making it a favored tool for enhancing user experience.

Vulnerability Details:

CVE-2024-1445, identified by researcher Richard Telleng (stueotue), reveals a significant flaw in versions up to and including 1.7.8 of the plugin. This vulnerability allows authenticated users with contributor-level permissions to inject malicious scripts through shortcodes, leading to stored cross-site scripting (XSS) attacks. The absence of adequate input sanitization and output escaping enables these scripts to execute whenever an affected page is accessed, posing a considerable risk to site integrity and user data.

Risks and Potential Impacts:

The exploitation of this vulnerability can have far-reaching consequences, from unauthorized data access and privacy breaches to the compromise of entire websites. For small business owners, the implications extend beyond technical disruptions, potentially eroding customer trust and tarnishing the business's reputation.

Remediation Strategies:

In response to this vulnerability, the developers promptly released version 1.7.9, which addresses the security flaw through improved input sanitization and output escaping. Users of the plugin are urged to update to this latest version immediately to mitigate the associated risks. Additionally, regularly monitoring access logs and reviewing site content for unexpected changes can help detect and prevent potential exploits.

Historical Context:

This is not the first vulnerability reported for the "Page scroll to id" plugin, with a previous issue documented since December 21, 2022. This history emphasizes the importance of continuous security assessments and updates in maintaining a secure online presence.


The identification and rectification of CVE-2024-1445 within the "Page scroll to id" plugin serve as a critical reminder of the ongoing need for diligence in the realm of website security. For small business owners, the challenge of staying abreast of such vulnerabilities may seem daunting amidst myriad responsibilities. However, the security of your website is integral to your business's digital trust and reliability. Leveraging automated update features, subscribing to security bulletins, and considering managed WordPress hosting services can significantly alleviate the burden, ensuring your website remains secure and your digital presence robust.

In navigating the complexities of online security, the key lies in proactive measures and informed decisions, safeguarding not just your digital assets but also the trust and confidence of your customers in your digital footprint.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Page scroll to id – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1445 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment