CVE-2024-12874
📋 TL;DR
The Top Comments WordPress plugin through version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite configurations where unfiltered_html is restricted. The vulnerability affects WordPress sites using this plugin.
💻 Affected Systems
- Top Comments WordPress Plugin
📦 What is this software?
Top Comments by Top Comments Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker with admin privileges could inject malicious JavaScript that steals session cookies, redirects users to phishing sites, or performs actions on behalf of authenticated users, potentially leading to full site compromise.
Likely Case
Malicious admin injects tracking scripts or defaces the site by modifying content visible to other users through the comments section.
If Mitigated
With proper user access controls and plugin restrictions, impact is limited to the specific admin user's actions within their authorized scope.
🎯 Exploit Status
Exploitation requires authenticated admin access. The vulnerability is in plugin settings that aren't properly sanitized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1 or later
Vendor Advisory: https://wpscan.com/vulnerability/7cc14a87-4605-49f6-9d51-0b9eb57e6c9d/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Top Comments' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, deactivate and delete plugin if no longer needed.
🔧 Temporary Workarounds
Remove Plugin
allDeactivate and delete the vulnerable plugin
wp plugin deactivate top-comments
wp plugin delete top-comments
Restrict Admin Access
allImplement strict access controls and monitor admin user activities
🧯 If You Can't Patch
- Remove the Top Comments plugin entirely from the WordPress installation
- Implement strict monitoring of admin user activities and plugin settings changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Top Comments' plugin version 1.0 or earlierCheck Version:
wp plugin list --name=top-comments --field=versionVerify Fix Applied:
Verify plugin version is 1.0.1 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to plugin settings
- Admin user making unexpected changes to comment-related settings
Network Indicators:
- Suspicious JavaScript payloads in HTTP POST requests to wp-admin/admin-ajax.php or similar endpoints
SIEM Query:
source="wordpress" AND (plugin="top-comments" AND version<="1.0")