Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
The MC4WP: Mailchimp for WordPress plugin is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to and including 4.9.16. This vulnerability is due to insufficient input sanitization and output escaping. It affects multi-site installations and installations where unfiltered_html has been disabled.
This vulnerability allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page. This can lead to various attacks, including theft of sensitive data, session hijacking, or manipulating the affected site's content for malicious purposes. The impact is somewhat limited due to the high privileges required for exploitation.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. The vulnerability has been fixed in version 4.9.17 of the MC4WP: Mailchimp for WordPress plugin. Users should update to this version or later to mitigate the vulnerability.
1. Update the MC4WP: Mailchimp for WordPress plugin to version 4.9.17 or later. 2. If immediate updating is not possible, consider temporarily disabling the plugin on multi-site installations or where unfiltered_html is disabled. 3. Implement the principle of least privilege, ensuring that administrator access is strictly limited to trusted users. 4. Regularly audit administrator-level accounts and their activities. 5. Implement Web Application Firewall (WAF) rules to detect and block XSS attempts. 6. Educate users about the risks of clicking on suspicious links or interacting with unexpected content on the website.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Feedly found the first article mentioning CVE-2024-8680. See article
Feedly estimated the CVSS score as LOW
NVD published the first details for CVE-2024-8680
A CVSS base score of 4.4 has been assigned.
EPSS Score was set to: 0.1% (Percentile: 42%)
A CVSS base score of 5.5 has been assigned.