Cyber Posture

CVE-2024-13875

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
10 April 2025
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0014 33.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Security Summary

CVE-2024-13875 is a reflected cross-site scripting (XSS) vulnerability affecting the WP-PManager WordPress plugin through version 1.2. The plugin fails to sanitize and escape a user-supplied parameter before outputting it back in the page, enabling attackers to inject and execute malicious JavaScript code in the context of the affected page. This issue is classified under CWE-79 (Cross-Site Scripting) and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability can be exploited remotely by any unauthenticated attacker with low attack complexity, though it requires user interaction such as clicking a malicious link. It targets high-privilege users like administrators, allowing the injected script to execute in their browser session upon interaction with the crafted payload. Successful exploitation could enable actions such as stealing session cookies, keystroke logging, or performing unauthorized operations on behalf of the victim.

Advisories, including the WPScan report at https://wpscan.com/vulnerability/82c54fb5-f1d9-4bae-a3de-d4335809b81c/, provide further details on detection and remediation for this vulnerability.

Details

CWE(s)
CWE-79

Affected Products

mantus667
wp-pmanager
≤ 1.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables remote exploitation (T1190) to execute arbitrary JavaScript (T1059.007) in admin browser sessions, directly facilitating web session cookie theft (T1539).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References