CVE-2024-13624

HIGHNuclei

WPMovieLibrary <= 2.1.4.8 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13624 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WPMovieLibrary

Default status: affected

CVE ListThrough 2.1.4.8affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site ScriptingCVSS 7.1

The WPMovieLibrary WordPress plugin through version 2.1.4.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'order' parameter in the import page before outputting it back, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.

Impact

Authenticated attackers can execute arbitrary JavaScript in an administrator's browser context via the order parameter, potentially leading to session hijacking or privilege escalation.

Remediation

Update WPMovieLibrary plugin to a version newer than 2.1.4.8.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024wpwordpresswp-pluginxsswpmovielibraryauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
FOFA: body="wp-content/plugins/wpmovielibrary/"
https://wpscan.com/vulnerability/c19b56cc-634f-420f-b6a0-9a10ad159049 https://nvd.nist.gov/vuln/detail/CVE-2024-13624

Source: ProjectDiscovery

References

2