CVE-2024-12568
📋 TL;DR
This vulnerability allows high-privilege WordPress users (like administrators) to inject malicious scripts into Workflow settings of the Email Subscribers by Icegram Express plugin. The stored XSS payload executes when other users view affected pages, even in environments where unfiltered_html is restricted. Only WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Email Subscribers by Icegram Express WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full site takeover, data theft, or malware distribution to visitors.
Likely Case
Privileged user injects scripts to steal session cookies, redirect users, or deface portions of the admin interface.
If Mitigated
Limited to admin-only exploitation with minimal impact if proper user access controls and monitoring are in place.
🎯 Exploit Status
Exploitation requires admin-level access. No public exploit code identified at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.45
Vendor Advisory: https://wpscan.com/vulnerability/0ce9075a-754b-474e-9620-17da8ee29b56/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Email Subscribers by Icegram Express'. 4. Click 'Update Now' if available, or manually update to version 5.7.45+. 5. Verify plugin version after update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
linuxDisable the vulnerable plugin until patching is possible.
wp plugin deactivate email-subscribers
🧯 If You Can't Patch
- Restrict admin access to only essential trusted users.
- Implement web application firewall (WAF) rules to block XSS payloads in plugin parameters.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for 'Email Subscribers by Icegram Express' version below 5.7.45.Check Version:
wp plugin get email-subscribers --field=versionVerify Fix Applied:
Confirm plugin version is 5.7.45 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin.php?page=es_workflows with script tags in parameters.
- Admin users modifying workflow settings unexpectedly.
Network Indicators:
- HTTP requests containing <script> tags in es_workflow parameters to WordPress admin endpoints.
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin.php" AND query="page=es_workflows") AND (body="<script>" OR body="javascript:")