CVE-2024-12321
Published: 27 January 2025
Summary
CVE-2024-12321 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Codexpert Wc Affiliate. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-12321 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, in the WC Affiliate WordPress plugin through version 2.3.9. The flaw arises because the plugin does not sanitize and escape a parameter before outputting it back in the page, enabling malicious script injection. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network accessibility, low attack complexity, no required privileges, user interaction dependency, and changed scope with low impacts across confidentiality, integrity, and availability.
Any unauthenticated remote attacker can exploit this vulnerability by crafting a malicious URL or payload that includes the unsanitized parameter. The attack requires tricking a targeted high-privilege user, such as an admin, into visiting the malicious page via social engineering, such as phishing. Upon interaction, the injected script executes in the victim's browser context, potentially allowing session token theft, account takeover, or further site compromise leveraging the victim's elevated permissions.
Advisories detailing mitigation are available from WPScan at https://wpscan.com/vulnerability/d4c55d30-1c15-41ee-95e0-670891d67684/. Security practitioners should consult these references for patch availability, workaround guidance, and affected configurations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50768
Vulnerability details
The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly matches exploitation of a public-facing application vulnerability for initial access and script execution in privileged user context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering and encoding of information output to prevent execution of injected scripts in the victim's browser context.
SI-10 mandates validation of unsanitized input parameters to block malicious payloads before they are processed and reflected.
SI-2 ensures timely remediation of the specific flaw in the WC Affiliate plugin through patching to address the sanitization and escaping deficiency.