CVE-2024-13880

HighPublic PoC

Published: 20 March 2025

Published

20 March 2025

Modified

08 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0019 40.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13880 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Dropstr My Quota. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2024-13880 is a reflected cross-site scripting (XSS) vulnerability in the My Quota WordPress plugin through version 1.0.8. The flaw arises because the plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a victim's browser. It is associated with CWE-79 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and potential scope change.

An unauthenticated attacker can exploit this vulnerability remotely by tricking a targeted user, such as a high-privilege administrator, into interacting with a maliciously crafted link or input containing the unsanitized parameter. Successful exploitation executes arbitrary JavaScript in the context of the victim's session, potentially enabling session hijacking, data theft, or further compromise of the WordPress site, particularly against admin users.

For mitigation details, refer to the advisory published by WPScan at https://wpscan.com/vulnerability/bee3b002-e808-4402-8bf6-4375ed7b3807/. The vulnerability was publicly disclosed on 2025-03-20.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-6751

Vulnerability details

The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

The reflected XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) via crafted links and allows execution of arbitrary JavaScript in the victim's browser (T1059.007), facilitating session hijacking or further actions.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0