Cyber Posture

CVE-2024-13876

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
09 April 2025
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0019 39.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2024-13876 is a reflected cross-site scripting (XSS) vulnerability affecting the mEintopf WordPress plugin through version 0.2.1. The flaw arises because the plugin fails to sanitize and escape a user-supplied parameter before outputting it back in the page, enabling attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser.

The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low complexity, no required privileges, and user interaction such as clicking a malicious link. Attackers can target high-privilege users, including administrators, to execute scripts that achieve low impacts on confidentiality, integrity, and availability with a changed scope, potentially leading to session theft, defacement, or other client-side attacks within the authenticated user's session.

The WPScan advisory at https://wpscan.com/vulnerability/d80cd18a-065f-443b-b548-d780b785d68e/ documents the issue and provides further technical details for practitioners.

Details

CWE(s)
CWE-79

Affected Products

tiefpunkt
meintopf
≤ 0.2.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Reflected XSS in public-facing WordPress plugin directly enables web app exploitation (T1190) and arbitrary JavaScript execution in victim browser (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References