CVE-2024-37245
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by the All In One Redirection WordPress plugin. When exploited, it enables cross-site scripting attacks that can steal user credentials, hijack sessions, or deface websites. All WordPress sites using this plugin from any version up to 2.2.0 are affected.
💻 Affected Systems
- Vsourz Digital All In One Redirection WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over the WordPress site, install backdoors, or redirect visitors to malicious sites.
Likely Case
Attackers steal user session cookies or credentials, perform actions on behalf of authenticated users, or deface the website.
If Mitigated
With proper input validation and output encoding, the attack would fail to execute malicious scripts.
🎯 Exploit Status
XSS vulnerabilities are commonly weaponized and this appears to be a reflected XSS requiring user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.2.0
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'All In One Redirection'. 4. Click 'Update Now' if available. 5. If no update is available, deactivate and delete the plugin.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate all-in-one-redirection
WAF Rule
allImplement Web Application Firewall rules to block XSS payloads
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Use input validation and output encoding in custom code that interacts with the plugin
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > All In One Redirection version. If version is 2.2.0 or earlier, you are vulnerable.Check Version:
wp plugin get all-in-one-redirection --field=versionVerify Fix Applied:
After updating, verify the plugin version is higher than 2.2.0 in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual GET/POST requests containing script tags or JavaScript code
- Multiple failed login attempts after visiting specific URLs
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in query parameters
- Unexpected redirects to external domains
SIEM Query:
source="wordpress.log" AND ("<script" OR "javascript:" OR "onload=" OR "onerror=")🔗 References
- https://patchstack.com/database/vulnerability/all-in-one-redirection/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
- https://patchstack.com/database/vulnerability/all-in-one-redirection/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
