CVE-2024-4856
📋 TL;DR
The FS Product Inquiry WordPress plugin through version 1.1.1 contains a reflected cross-site scripting (XSS) vulnerability. Attackers can inject malicious scripts via unsanitized parameters, which execute when viewed by users - including administrators. Both authenticated and unauthenticated users can be targeted.
💻 Affected Systems
- FS Product Inquiry WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full WordPress site takeover, data theft, or malware distribution to visitors.
Likely Case
Session hijacking, credential theft, or defacement of vulnerable pages for authenticated users.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
Simple reflected XSS requiring user interaction but trivial to weaponize in phishing campaigns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2 or later
Vendor Advisory: https://wpscan.com/vulnerability/6cf90a27-55e2-4b2c-9df1-5fa34c1bd9d1/
Restart Required: No
Instructions:
1. Update plugin to version 1.1.2 or later via WordPress admin dashboard. 2. Navigate to Plugins > Installed Plugins. 3. Find FS Product Inquiry and click Update Now. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate fs-product-inquiry
Web Application Firewall Rule
allBlock malicious parameter patterns containing script tags or JavaScript.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution.
- Use browser security extensions that block reflected XSS attacks.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin dashboard for plugin version 1.1.1 or earlier.Check Version:
wp plugin get fs-product-inquiry --field=versionVerify Fix Applied:
Confirm plugin version is 1.1.2 or later in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual GET/POST requests with script tags or JavaScript in parameters
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in query parameters
- Suspicious redirects to external domains
SIEM Query:
source="web_server" AND ("<script>" OR "javascript:" OR "onload=" OR "onerror=")