CVE-2024-10149
📋 TL;DR
The Social Slider Feed WordPress plugin before version 2.2.9 contains a stored cross-site scripting (XSS) vulnerability in its settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite installations where unfiltered_html is restricted. Only WordPress sites using vulnerable versions of this specific plugin are affected.
💻 Affected Systems
- Social Slider Feed WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with admin privileges could inject malicious JavaScript that steals session cookies, redirects users to phishing sites, or performs actions on behalf of authenticated users, potentially leading to complete site compromise.
Likely Case
Malicious admin injects scripts that affect other users viewing plugin content, potentially stealing credentials or performing unauthorized actions.
If Mitigated
With proper user access controls and regular plugin updates, impact is limited to potential minor data exposure from trusted administrators.
🎯 Exploit Status
Exploitation requires administrative access to WordPress. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.9
Vendor Advisory: https://wpscan.com/vulnerability/1619dc4b-4e5e-4b82-820b-3c4e732db3ad/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Social Slider Feed' and click 'Update Now'. 4. Verify version shows 2.2.9 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate social-slider-feed
Restrict Admin Access
allLimit administrative accounts to trusted personnel only
🧯 If You Can't Patch
- Remove the Social Slider Feed plugin completely
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Social Slider Feed → Version. If version is below 2.2.9, system is vulnerable.Check Version:
wp plugin get social-slider-feed --field=versionVerify Fix Applied:
After update, confirm version shows 2.2.9 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin setting modifications by admin users
- Multiple failed update attempts for Social Slider Feed plugin
Network Indicators:
- Unexpected JavaScript in plugin settings pages
- Suspicious outbound connections from plugin content pages
SIEM Query:
source="wordpress" AND (plugin="social-slider-feed" AND version<"2.2.9")