CVE-2024-8505

Improper Neutralization of Alternate XSS Syntax (CWE-87)

Published: Oct 2, 2024 / Updated: 48d ago

010
CVSS 5.4EPSS 0.07%Medium
CVE info copied to clipboard

Summary

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_label' parameter in all versions up to, and including, 7.1.2. This vulnerability is due to insufficient input sanitization and output escaping. It allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages, which will execute whenever a user accesses an injected page.

Impact

This vulnerability can lead to the execution of malicious scripts in users' browsers when they visit affected pages. Potential impacts include: 1. Theft of sensitive information: Attackers could steal cookies, session tokens, or other critical information stored in the browser. 2. Account takeover: The vulnerability could be exploited to perform actions on behalf of the victim, potentially leading to account compromise. 3. Defacement: Attackers could modify the content of the affected pages, potentially damaging the site's reputation. 4. Malware distribution: The injected scripts could be used to redirect users to malicious sites or download malware. 5. Phishing attacks: Attackers could inject convincing phishing forms to steal user credentials. The impact is heightened by the fact that the scripts will execute for any user visiting the affected page, potentially including administrators.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, since the vulnerability affects "all versions up to, and including, 7.1.2" of the WordPress Infinite Scroll – Ajax Load More plugin, it is likely that a patched version newer than 7.1.2 is available or will be released soon. Users should check for updates and apply them as soon as they become available.

Mitigation

1. Update the WordPress Infinite Scroll – Ajax Load More plugin to a version newer than 7.1.2 as soon as a patch becomes available. 2. Implement strong access controls to limit the number of users with Contributor-level access or higher. 3. Regularly audit user accounts and their permission levels. 4. Implement Web Application Firewall (WAF) rules to detect and block XSS attempts. 5. Use Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks. 6. Conduct regular security audits of the WordPress installation and all plugins. 7. Educate content contributors about the risks of XSS and proper content handling practices. 8. Consider temporarily disabling the plugin if an immediate update is not possible and the risk is deemed high for your environment.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8505. See article

Oct 2, 2024 at 9:44 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 2, 2024 at 9:45 AM
CVE Assignment

NVD published the first details for CVE-2024-8505

Oct 2, 2024 at 10:15 AM
CVSS

A CVSS base score of 6.4 has been assigned.

Oct 2, 2024 at 10:20 AM / nvd
EPSS

EPSS Score was set to: 0.07% (Percentile: 30.7%)

Oct 3, 2024 at 11:00 AM
Static CVE Timeline Graph

Affected Systems

Connekthq/ajax_load_more
+null more

Patches

plugins.trac.wordpress.org
+null more

Attack Patterns

CAPEC-199: XSS Using Alternate Syntax
+null more

News

WordPress Vulnerability & Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
WordPress Vulnerability &amp; Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
WordPress Vulnerability &amp; Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 30, 2024 to October 6, 2024)
All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers WordPress Plugins with Reported Vulnerabilities Last Week
Update Thu Oct 10 14:37:03 UTC 2024
Update Thu Oct 10 14:37:03 UTC 2024
See 11 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI