CVE-2024-13504
Published: 31 January 2025
Summary
CVE-2024-13504 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13504 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress. It affects all versions up to and including 1.7.42 due to insufficient input sanitization and output escaping in the handling of dfxp file uploads. This issue is limited to Apache-based environments, where dfxp files are processed by default, enabling injection of arbitrary web scripts into pages.
Unauthenticated attackers can exploit the vulnerability over the network with low complexity, no privileges, and no user interaction required, as reflected in its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). By uploading a malicious dfxp file, attackers inject scripts that execute whenever any user accesses the file, potentially leading to low-level impacts on confidentiality and integrity with a changed scope.
Advisories from Wordfence provide threat intelligence details, while WordPress plugin repository references indicate mitigation through updates, including code changes in the trunk (changeset from 3229309 to 3231372) and examination of tag 1.7.40, suggesting patches in subsequent versions beyond 1.7.42.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51637
Vulnerability details
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output…
more
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of the application via malicious file upload.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs, directly mitigating the insufficient input sanitization that allows malicious dfxp file uploads leading to stored XSS.
SI-15 mandates filtering of information outputs, addressing the lack of output escaping that enables execution of injected scripts when dfxp files are accessed.
SI-2 ensures timely flaw remediation, such as patching the WordPress plugin to fix the sanitization and escaping deficiencies exploited in this CVE.