CVE-2024-13711
📋 TL;DR
The Pollin WordPress plugin has a reflected cross-site scripting vulnerability in all versions up to 1.01.1. Unauthenticated attackers can inject malicious scripts via the 'question' parameter, which could steal user credentials or session cookies when victims click specially crafted links. Any WordPress site using the vulnerable Pollin plugin is affected.
💻 Affected Systems
- Pollin WordPress Plugin
📦 What is this software?
Pollin by Bin Co
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, take over the WordPress site, install backdoors, or redirect users to malicious sites.
Likely Case
Attackers steal user session cookies or credentials through phishing links, potentially compromising individual user accounts.
If Mitigated
With proper web application firewalls and user awareness training, impact is limited to failed exploitation attempts.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but is trivial to execute once the link is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.01.2 or later
Vendor Advisory: https://wordpress.org/plugins/pollin/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Pollin plugin and click 'Update Now'. 4. Verify version is 1.01.2 or higher.
🔧 Temporary Workarounds
Disable Pollin Plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate pollin
Web Application Firewall Rule
allBlock requests containing malicious script patterns in the 'question' parameter
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution
- Educate users about phishing risks and suspicious links
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for Pollin version ≤1.01.1Check Version:
wp plugin get pollin --field=versionVerify Fix Applied:
Confirm Pollin plugin version is 1.01.2 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests with suspicious script tags in 'question' parameter
- Multiple failed XSS attempts from same IP
Network Indicators:
- Unusual GET requests with encoded script payloads in query parameters
SIEM Query:
web.url:*question=*<script* OR web.url:*question=*javascript:*