Cyber Posture

CVE-2024-13668

HighPublic PoC

Published: 07 March 2025

Published
07 March 2025
Modified
21 May 2025
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0020 42.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution.

Security Summary

CVE-2024-13668 is a reflected cross-site scripting (XSS) vulnerability affecting the WordPress Activity O Meter plugin through version 1.0. The plugin fails to sanitize and escape a user-supplied parameter before outputting it back in the page, enabling attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser. This issue is classified under CWE-79 (Cross-Site Scripting) and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability can be exploited remotely by unauthenticated attackers (PR:N) over the network (AV:N) with low complexity (AC:L), though it requires user interaction such as clicking a malicious link (UI:R). It targets high-privilege users like site administrators, allowing attackers to execute scripts in their session context with a changed scope (S:C), potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking or unauthorized actions.

Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/a7bfc094-b235-419d-882d-96b439651f65/, published on 2025-03-07. Security practitioners should review it for patch information or workarounds specific to the plugin.

Details

CWE(s)
CWE-79

Affected Products

erwinwolff
wordpress activity-o-meter
≤ 1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables T1190 (exploit public-facing app), T1059.007 (arbitrary JS execution in browser), and T1204.001 (malicious link delivery requiring user click).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References