Cyber Posture

CVE-2024-13574

HighPublic PoC

Published: 11 March 2025

Published
11 March 2025
Modified
29 August 2025
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0015 34.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Security Summary

CVE-2024-13574 is a reflected cross-site scripting (XSS) vulnerability in the XV Random Quotes WordPress plugin through version 1.40. The flaw arises because the plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a victim's browser. This issue is classified under CWE-79 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Attackers can exploit this vulnerability remotely without privileges by tricking a targeted user, such as an administrator, into interacting with a maliciously crafted link or page. Successful exploitation executes arbitrary JavaScript in the context of the victim's browser, potentially enabling session hijacking, theft of sensitive data, or further actions limited by the low confidentiality, integrity, and availability impacts. The requirement for user interaction makes it suitable for phishing campaigns aimed at high-privilege WordPress users.

Advisories from WPScan detail the vulnerability at https://wpscan.com/vulnerability/7eb9ef20-5d34-425e-b7fc-38a769d0a822/, where security practitioners should consult for specific detection, patch availability, and mitigation guidance, such as updating to a fixed version beyond 1.40 or implementing input validation.

Details

CWE(s)
CWE-79

Affected Products

xavivars
xv random quotes
≤ 1.40

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables direct exploitation of the web app (T1190), delivery via crafted malicious links in phishing (T1566.002), arbitrary JavaScript execution in browser (T1059.007), and session hijacking (T1185) as explicitly noted in the description.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References