CVE-2024-12749
Published: 29 January 2025
Summary
CVE-2024-12749 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Raiserweb Competition Form. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 17.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-12749 is a reflected cross-site scripting (XSS) vulnerability in the Competition Form WordPress plugin through version 2.0. The plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a user's browser. This issue is classified under CWE-79 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and potential scope change.
An attacker can exploit this vulnerability remotely without authentication by crafting a malicious URL containing the unsanitized parameter and tricking a targeted user, such as a high-privilege administrator, into interacting with it, typically via a phishing link or social engineering. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling session hijacking, data theft, or further actions limited by the low confidentiality, integrity, and availability impacts outlined in the CVSS score.
Advisories are available from WPScan at https://wpscan.com/vulnerability/478316b9-9f47-4aa6-92c6-03879f16a3e5/, which documents the vulnerability details but does not specify patch availability in the provided information. Security practitioners should update the plugin beyond version 2.0 where possible and implement content security policies to mitigate XSS risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51085
Vulnerability details
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables crafted malicious links (phishing) that execute JS in browser context upon interaction, directly mapping to drive-by compromise and spearphishing link delivery.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring filtering of output to prevent injection of malicious scripts into web pages.
Addresses the unsanitized input parameter by enforcing validation of inputs to reject malicious payloads before processing.
Ensures timely remediation of the plugin flaw through identification, reporting, and correction of vulnerabilities like this XSS issue.