CVE-2024-56023
Published: 02 January 2025
Summary
CVE-2024-56023 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-56023 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, in the PerfectSolution WP eCommerce Quickpay WordPress plugin (wp-ecommerce-quickpay). This issue affects all versions of the plugin up to and including 1.1.0. The vulnerability has a CVSS v3.1 base score of 7.1, rated High severity, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
Attackers can exploit this reflected XSS vulnerability remotely over the network with low complexity and no required privileges, though it requires user interaction such as clicking a malicious link. Successful exploitation allows execution of arbitrary scripts in the victim's browser context, potentially leading to low-impact confidentiality, integrity, and availability effects with a changed scope, such as session hijacking, data theft, or phishing within the affected WordPress site.
Patchstack advisories detail the vulnerability and recommend updating to a patched version beyond 1.1.0 or disabling the plugin, as referenced at https://patchstack.com/database/Wordpress/Plugin/wp-ecommerce-quickpay/vulnerability/wordpress-wp-ecommerce-quickpay-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52921
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickpay allows Reflected XSS.This issue affects WP eCommerce Quickpay: from n/a through <= 1.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote script injection (T1190) and JavaScript execution in victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to prevent reflected XSS by neutralizing malicious scripts before they are rendered in the victim's browser.
SI-10 enforces validation of inputs to the WordPress plugin, directly addressing improper neutralization that enables reflected XSS attacks.
SI-2 mandates timely identification, reporting, and correction of flaws like the plugin's XSS vulnerability through patching or disabling.