CVE-2024-5799
📋 TL;DR
The CM Pop-Up Banners WordPress plugin before version 1.7.3 contains a stored cross-site scripting (XSS) vulnerability in popup fields. This allows authenticated users with Contributor-level permissions or higher to inject malicious scripts that execute when other users view the affected popups. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- CM Pop-Up Banners for WordPress
📦 What is this software?
Cm Popup by Cminds
⚠️ Risk & Real-World Impact
Worst Case
A malicious contributor could inject scripts that steal administrator session cookies, redirect users to phishing sites, or perform actions as authenticated users, potentially leading to site takeover.
Likely Case
Contributors could deface popups with malicious content, display unwanted ads, or steal visitor data through injected JavaScript.
If Mitigated
With proper user role management and content filtering, impact is limited to popup content manipulation without broader site compromise.
🎯 Exploit Status
Exploitation requires Contributor-level access. The vulnerability is in stored content fields, making attacks persistent.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.3
Vendor Advisory: https://wpscan.com/vulnerability/3ee3023a-541c-40e6-8d62-24b4b110633c/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'CM Pop-Up Banners' and click 'Update Now'. 4. Verify version shows 1.7.3 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate cm-popup-banners
Restrict User Roles
allTemporarily remove Contributor role permissions or downgrade users
🧯 If You Can't Patch
- Remove Contributor role from untrusted users or restrict to Author/Editor roles only
- Implement web application firewall (WAF) rules to block XSS payloads in POST requests to WordPress admin
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for CM Pop-Up Banners versionCheck Version:
wp plugin list --name='CM Pop-Up Banners' --field=versionVerify Fix Applied:
Confirm plugin version is 1.7.3 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with popup-related parameters
- Multiple popup creation/modification events by Contributor users
Network Indicators:
- JavaScript payloads in HTTP POST parameters to WordPress admin endpoints
SIEM Query:
source="wordpress.log" AND ("cm-popup" OR "popup_banner") AND (POST OR admin-ajax) AND (script OR javascript OR onload)