CVE-2024-13377
Published: 17 January 2025
Summary
CVE-2024-13377 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gravityforms (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13377 is a stored cross-site scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.9.1.3. The flaw stems from insufficient input sanitization and output escaping of the 'alt' parameter, allowing arbitrary web scripts to be injected into pages. It is classified under CWE-79 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and changed scope.
Unauthenticated attackers can exploit this vulnerability remotely by submitting malicious payloads via the 'alt' parameter, which get stored and rendered on affected pages. When any user, including administrators, accesses these injected pages, the scripts execute in their browser context, potentially leading to session hijacking, data theft, or further site compromise through low confidentiality and integrity impacts.
Mitigation details are available in the Gravity Forms change log at https://docs.gravityforms.com/gravityforms-change-log/, which documents patches in versions beyond 2.9.1.3, and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/03623f00-2c3c-4590-92fe-a5eaac15b944?source=cve, recommending immediate updates to the latest plugin version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51565
Vulnerability details
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
more
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of a web application vulnerability without auth or user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates insufficient input sanitization of the 'alt' parameter by enforcing validation to block malicious script injection into Gravity Forms.
Addresses lack of output escaping by requiring filtering of the 'alt' parameter when rendered, preventing execution of stored scripts in user browsers.
Ensures timely patching of the Gravity Forms flaw up to version 2.9.1.3, eliminating the stored XSS vulnerability as recommended in mitigation details.