CVE-2024-37495
📋 TL;DR
This stored XSS vulnerability in the Mediavine Create WordPress plugin allows attackers to inject malicious scripts into web pages that are then executed when other users view those pages. It affects all WordPress sites using the Mediavine Create plugin versions up to 1.9.7. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- WordPress Create by Mediavine plugin
📦 What is this software?
Create by Mediavine
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over the WordPress site, install backdoors, deface the website, or use the compromised site to attack visitors.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies, redirect users to phishing sites, or perform actions as authenticated users.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be neutralized and rendered harmless.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited and weaponized. While no public PoC is mentioned, stored XSS is relatively easy to exploit once the injection point is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.8 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Create by Mediavine' and click 'Update Now'. 4. Alternatively, download version 1.9.8+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable plugin temporarily
allDeactivate the vulnerable plugin until patched
wp plugin deactivate mediavine-create
Implement WAF rules
allAdd XSS protection rules to web application firewall
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Enable WordPress security plugins with XSS protection features
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Create by Mediavine' versionCheck Version:
wp plugin get mediavine-create --field=versionVerify Fix Applied:
Verify plugin version is 1.9.8 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to plugin endpoints
- Suspicious JavaScript in database content fields
Network Indicators:
- Malicious script tags in HTTP requests to WordPress admin
- Unexpected redirects from plugin pages
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path CONTAINS "mediavine") AND (http_method="POST" AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:"))🔗 References
- https://patchstack.com/database/vulnerability/mediavine-create/wordpress-create-by-mediavine-plugin-1-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/mediavine-create/wordpress-create-by-mediavine-plugin-1-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
