CVE-2024-11910
📋 TL;DR
The WP Crowdfunding WordPress plugin has a stored cross-site scripting vulnerability in its search block. Authenticated attackers with Contributor-level access or higher can inject malicious scripts that execute when users view affected pages. This affects all versions up to and including 2.1.12.
💻 Affected Systems
- WP Crowdfunding WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Likely Case
Attackers with contributor access inject malicious scripts to steal user session cookies or display phishing content to visitors.
If Mitigated
With proper user role management and input validation, impact is limited to low-privilege user account compromise.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has Contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.13
Vendor Advisory: https://wordpress.org/plugins/wp-crowdfunding/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Crowdfunding plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.1.13+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable block
allRemove or disable the wp-crowdfunding/search block from all pages/posts
Restrict user roles
allTemporarily remove Contributor role access or implement stricter role-based access controls
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in search parameters
- Regularly audit user accounts and remove unnecessary Contributor-level access
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Crowdfunding version. If version is 2.1.12 or lower, you are vulnerable.Check Version:
wp plugin list --name=wp-crowdfunding --field=version (if WP-CLI is installed)Verify Fix Applied:
After updating, verify WP Crowdfunding plugin version is 2.1.13 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to search functionality with script tags or JavaScript payloads
- Multiple failed login attempts followed by successful Contributor-level login
Network Indicators:
- HTTP requests containing malicious script payloads in search parameters
- Outbound connections to suspicious domains from your WordPress site
SIEM Query:
source="wordpress.log" AND ("wp-crowdfunding" OR "search") AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")🔗 References
- https://plugins.trac.wordpress.org/browser/wp-crowdfunding/trunk/includes/blocks/Search.php#L70
- https://plugins.trac.wordpress.org/changeset/3206336/wp-crowdfunding/trunk/includes/blocks/Search.php
- https://wordpress.org/plugins/wp-crowdfunding/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b1541aaf-9f35-44b5-a985-1b8d33228f0a?source=cve
