CVE-2024-29774
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by the WP Directory Kit WordPress plugin. When users visit a specially crafted URL, the script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf. All WordPress sites using WP Directory Kit versions up to 1.2.9 are affected.
💻 Affected Systems
- WP Directory Kit WordPress Plugin
📦 What is this software?
Wp Directory Kit by Wpdirectorykit
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over WordPress sites, deface websites, or redirect users to malicious sites.
Likely Case
Attackers steal user session cookies, perform actions as authenticated users, or redirect users to phishing pages.
If Mitigated
With proper input validation and output encoding, the XSS payload would be neutralized before reaching users.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited via phishing campaigns. Attackers need to trick users into clicking malicious links containing the XSS payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.0 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wp-directory-kit-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Directory Kit. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.3.0+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable WP Directory Kit Plugin
linuxTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wpdirectorykit
Implement WAF Rules
allAdd web application firewall rules to block XSS payloads
# Configure WAF to filter <script> tags and JavaScript events in URL parameters
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Use browser security features like HttpOnly cookies and SameSite attributes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Directory Kit version. If version is 1.2.9 or lower, you are vulnerable.Check Version:
wp plugin get wpdirectorykit --field=versionVerify Fix Applied:
After updating, verify WP Directory Kit version is 1.3.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual long URLs with script tags or JavaScript in parameters
- Multiple failed requests with XSS payload patterns
Network Indicators:
- HTTP requests containing <script>, javascript:, or on* event handlers in URL parameters
SIEM Query:
source="web_server_logs" AND (uri="*<script>*" OR uri="*javascript:*" OR uri="*onclick=*" OR uri="*onload=*")🔗 References
- https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wp-directory-kit-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wp-directory-kit-plugin-1-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
