CVE-2024-6753

HIGHNuclei

Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6753 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 24, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 24, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Social Auto Poster

Browse WPWeb / Social Auto Poster

Default status: unaffected

CVE ListThrough 5.3.14affected

social_auto_poster

Browse wpwebinfotech / social_auto_poster
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHSocial Auto Poster <= 5.3.14 - Stored Cross-Site ScriptingCVSS 7.2

Social Auto Poster plugin for WordPress versions up to 5.3.14 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'mapTypes' parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.

Remediation

Update to the latest version of the plugin where the vulnerability is fixed.

WeaknessesCWE-79
AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginsocial-auto-posterxssvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Shodan: http.component:"WordPress"
FOFA: body="social-auto-poster"
https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2 https://patchstack.com/database/vulnerability/social-auto-poster/wordpress-social-auto-poster-plugin-5-3-14-unauthenticated-stored-cross-site-scripting-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2024-6753

Source: ProjectDiscovery

References

3