CVE-2024-56289
Published: 07 January 2025
Summary
CVE-2024-56289 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-56289 is a reflected cross-site scripting vulnerability arising from improper neutralization of input during web page generation. It affects the Groundhogg WordPress plugin developed by Adrian Tobey, impacting all versions through 3.7.3.3. The flaw is tracked under CWE-79 and carries a CVSS 3.1 score of 7.1.
An unauthenticated attacker can exploit the issue by crafting a malicious link that, when clicked by a victim, executes arbitrary script in the context of the affected site. Successful exploitation can lead to theft of session tokens or other sensitive data, unauthorized actions performed on behalf of the user, or limited impact to site integrity and availability.
The single referenced advisory from Patchstack identifies the reflected XSS condition in the plugin and points to the availability of a fixed version beyond 3.7.3.3. Site operators are advised to update the Groundhogg plugin promptly to a patched release.
EPSS for the CVE remains flat at 0.0991 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53086
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through <= 3.7.3.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) via malicious links requiring user interaction (T1204.001) to achieve JavaScript execution in the browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 mandates filtering of information outputs, directly preventing reflected XSS payloads from being improperly neutralized and executed during web page generation.
SI-10 enforces validation of inputs, blocking malicious payloads before they can be reflected in web pages by the Groundhogg plugin.
SI-2 requires timely flaw remediation, such as patching the Groundhogg plugin beyond version 3.7.3.3 to eliminate the specific XSS vulnerability.