CVE-2024-56035
Published: 02 January 2025
Summary
CVE-2024-56035 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-56035 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Kurt Payne Upload Scanner (upload-scanner) WordPress plugin. This issue affects all versions of the plugin from its initial release through 1.2 inclusive. The vulnerability was published on 2025-01-02 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it requires user interaction such as clicking a malicious link. Upon successful exploitation, attackers achieve low impacts on confidentiality, integrity, and availability, with a changed scope that elevates the overall severity.
Patchstack provides details on this Reflected XSS vulnerability in the WordPress Upload Scanner plugin version 1.2 via their database advisory at https://patchstack.com/database/Wordpress/Plugin/upload-scanner/vulnerability/wordpress-upload-scanner-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52933
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in victim browser (T1059.007) and is triggered via crafted malicious links requiring user click (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly prevents reflected XSS in the Upload Scanner plugin by requiring filtering of information output to web pages to neutralize untrusted input.
SI-10 mitigates the vulnerability by validating and sanitizing user inputs before processing, reducing the risk of malicious payloads being reflected in the plugin's web output.
SI-2 addresses the flaw by requiring timely identification, reporting, and correction of the XSS vulnerability through patching the Upload Scanner plugin up to version 1.2.