CVE-2024-13625
Published: 17 February 2025
Summary
CVE-2024-13625 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gualdoni Tube Video Ads Lite. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked in the top 13.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13625 is a reflected cross-site scripting (XSS) vulnerability in the Tube Video Ads Lite WordPress plugin through version 1.5.7. The flaw arises because the plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a user's browser. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-79 (Cross-Site Scripting).
An unauthenticated attacker can exploit this vulnerability remotely with low complexity by tricking a targeted high-privilege user, such as an administrator, into interacting with a maliciously crafted link or page (e.g., via phishing). Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling session hijacking, theft of sensitive data, or further actions limited by the low confidentiality, integrity, and availability impacts, though the changed scope elevates the risk against privileged accounts.
The WPScan advisory at https://wpscan.com/vulnerability/6bfabf1d-86f2-4d29-bc55-d618d757dcc6/ provides detailed information on the vulnerability, including mitigation recommendations such as updating to a patched version of the plugin if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51695
Vulnerability details
The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution in browser (T1059.007) and session hijacking (T1185); delivered via malicious link/phishing (T1566.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the flaw by updating the Tube Video Ads Lite plugin to a patched version directly eliminates the reflected XSS vulnerability.
Filtering information prior to output prevents the unsanitized parameter from injecting and executing malicious scripts in users' browsers.
Validating input parameters ensures malicious payloads are rejected or sanitized before processing, mitigating the root cause of the reflected XSS.