CVE-2024-13352
Published: 07 February 2025
Summary
CVE-2024-13352 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Alwayscurious Legull. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13352 is a reflected cross-site scripting (XSS) vulnerability affecting the Legull WordPress plugin through version 1.2.2. The plugin fails to sanitize and escape a parameter before outputting it back in the page, enabling malicious script injection. Published on 2025-02-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low attack complexity, though it requires user interaction such as clicking a malicious link. It targets high-privilege users like administrators, allowing arbitrary JavaScript execution in their browser context upon successful payload delivery. Potential outcomes include session hijacking, credential theft, or unauthorized actions under the victim's privileges, with low impacts to confidentiality, integrity, and availability but changed scope due to cross-origin effects.
Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/2c141cc0-f79e-42bd-97a6-98829647104c/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51550
Vulnerability details
The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and arbitrary JavaScript execution in victim browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the failure to sanitize and escape the vulnerable parameter before output, preventing malicious script injection in reflected XSS attacks.
Validates the unsanitized input parameter to reject or clean malicious payloads before they are reflected back in the page.
Remediates the specific flaw in the Legull WordPress plugin by identifying, patching, and deploying updates to versions that properly sanitize and escape the parameter.