CVE-2024-13349 – The Stockdio Historical Chart WordPress plugin ... (How to Fix)

Q: What is the severity of CVE-2024-13349?

CVE-2024-13349 has a CVSS score of 6.4 (MEDIUM). The Stockdio Historical Chart WordPress plugin has a stored XSS vulnerability in all versions up to 2.8.18. Authenticated attackers with contributor-level access or higher can inject malicious scripts via the plugin's shortcode attributes, which execute when users view affected pages. This affects all WordPress sites using vulnerable versions of this plugin.

📋 TL;DR

The Stockdio Historical Chart WordPress plugin has a stored XSS vulnerability in all versions up to 2.8.18. Authenticated attackers with contributor-level access or higher can inject malicious scripts via the plugin's shortcode attributes, which execute when users view affected pages. This affects all WordPress sites using vulnerable versions of this plugin.

💻 Affected Systems

Products:

Stockdio Historical Chart WordPress Plugin

Versions: All versions up to and including 2.8.18

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin enabled. Contributor-level authentication is required for exploitation.

📦 What is this software?

Stockdio Historical Chart by Stockdio

View all CVEs affecting Stockdio Historical Chart →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor accounts inject malicious scripts to steal user session cookies or redirect visitors to phishing pages.

🟢

If Mitigated

With proper user access controls and content sanitization, impact is limited to potential data exposure from compromised contributor accounts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once an attacker has contributor privileges.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.8.19 or later

Vendor Advisory: https://wordpress.org/plugins/stockdio-historical-chart/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Stockdio Historical Chart' and click 'Update Now'. 4. Verify version is 2.8.19 or higher.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate stockdio-historical-chart

Restrict User Roles

all

Limit contributor-level access to trusted users only

🧯 If You Can't Patch

Remove contributor role from untrusted users
Implement web application firewall with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for Stockdio Historical Chart version

Check Version:

wp plugin get stockdio-historical-chart --field=version

Verify Fix Applied:

Confirm plugin version is 2.8.19 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin with stockdio-historical-chart parameters
Multiple failed login attempts followed by successful contributor login

Network Indicators:

Script tags with unusual attributes in stockdio plugin requests

SIEM Query:

source="wordpress.log" AND "stockdio-historical-chart" AND ("script" OR "onerror" OR "onload")

📊 Metadata

CVE ID: CVE-2024-13349

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.09% exploit probability (25.3th percentile)

Published: January 30, 2025

Last Updated: January 31, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13349, you might also want to check these: