CVE-2024-2189
📋 TL;DR
This vulnerability in the Social Icons Widget & Block by WPZOOM WordPress plugin allows administrators to inject malicious scripts into widget settings, which then execute in other users' browsers. It affects WordPress sites using vulnerable plugin versions, particularly in multisite configurations where unfiltered_html is restricted.
💻 Affected Systems
- Social Icons Widget & Block by WPZOOM WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leads to site takeover, data theft, or malware distribution to visitors.
Likely Case
Malicious admin injects scripts to steal session cookies, redirect users, or deface the site.
If Mitigated
Limited to admin users only, with minimal impact if proper user access controls are enforced.
🎯 Exploit Status
Exploitation requires admin privileges; proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.18
Vendor Advisory: https://wpscan.com/vulnerability/b8661fbe-78b9-4d29-90bf-5b68af468eb6/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Social Icons Widget & Block by WPZOOM'. 4. Click 'Update Now' if available, or manually update to version 4.2.18 or later.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the plugin until patched.
wp plugin deactivate social-icons-widget-by-wpzoom
Restrict admin access
allLimit administrative accounts to trusted users only.
🧯 If You Can't Patch
- Remove admin privileges from untrusted users.
- Implement web application firewall (WAF) rules to block XSS payloads.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins.Check Version:
wp plugin get social-icons-widget-by-wpzoom --field=versionVerify Fix Applied:
Confirm plugin version is 4.2.18 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity modifying widget settings
- Script tags in widget configuration data
Network Indicators:
- Unexpected JavaScript execution from widget content
SIEM Query:
source="wordpress" AND event="plugin_update" AND plugin_name="social-icons-widget-by-wpzoom" AND version<"4.2.18"