ExploitCVE-2024-10592
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
Summary
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0. This vulnerability is due to insufficient input sanitization and output escaping. It allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page.
Impact
This vulnerability can have significant impacts: 1. Data theft: Attackers could potentially steal sensitive information from users who view the affected pages, including session cookies, authentication tokens, or other personal data. 2. Account takeover: The injected scripts could be used to perform actions on behalf of the victim, potentially leading to account compromise. 3. Malware distribution: Attackers could inject scripts that redirect users to malicious sites or download malware onto their devices. 4. Defacement: The appearance and content of the affected pages could be altered, potentially damaging the site's reputation. 5. Phishing: Injected scripts could create convincing phishing forms to steal user credentials. The impact is heightened by the fact that the XSS is stored, meaning the malicious script persists on the server and affects all users who view the compromised page, not just the initial target.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
As of the time this vulnerability was reported, a patch was not explicitly mentioned. However, given that the vulnerability affects "all versions up to, and including, 1.6.0" of the Mapster WP Maps plugin, it is likely that a patched version (presumably 1.6.1 or higher) will be or has been released. Users should check for updates to the Mapster WP Maps plugin and apply them as soon as they become available.
Mitigation
Until a patch is available, consider the following mitigation strategies: 1. Temporarily disable the Mapster WP Maps plugin if it's not critical to your website's functionality. 2. Limit user roles: Restrict Contributor-level access and above to only trusted users, as the vulnerability requires authentication. 3. Implement Web Application Firewall (WAF) rules to detect and block XSS attempts. 4. Regularly audit and review user-generated content, especially from users with Contributor-level access and above. 5. Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks. 6. Educate users about the risks of clicking on suspicious links or interacting with unexpected content on the website. 7. Monitor logs for suspicious activities related to the Mapster WP Maps plugin. Once a patch is available, prioritize its application immediately to resolve the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Timeline
NVD published the first details for CVE-2024-10592
Feedly found the first article mentioning CVE-2024-10592. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 15.3%)