CVE-2024-13624
Published: 26 February 2025
Summary
CVE-2024-13624 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Caercam Wpmovielibrary. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13624 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the WPMovieLibrary WordPress plugin in versions through 2.1.4.8. The flaw arises because the plugin does not sanitize and escape a parameter before outputting it back in the page, enabling malicious script injection. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious links or payloads that reflect unsanitized input. Exploitation requires tricking a targeted user, particularly high-privilege accounts such as administrators, into interacting with the malicious content via their browser. Successful attacks can lead to script execution in the victim's context, potentially allowing limited impacts like session token theft, phishing, or unauthorized actions on behalf of the user.
The WPScan advisory at https://wpscan.com/vulnerability/c19b56cc-634f-420f-b6a0-9a10ad159049/ provides detailed information on the vulnerability, including exploitation vectors and recommended mitigations for affected WordPress installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5311
Vulnerability details
The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of an Internet-facing application (T1190) via crafted malicious links that execute scripts in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring filtering or encoding of output before rendering, preventing malicious script execution from unsanitized parameters.
Validates and sanitizes input parameters to reject or neutralize XSS payloads before they are processed and reflected in the page.
Requires timely patching of the vulnerable WordPress plugin version to remediate the specific flaw in parameter sanitization and escaping.