CVE-2024-5902
📋 TL;DR
This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress feedback forms via the name parameter. When high-privileged users view these compromised form responses, the scripts execute in their browser context. All WordPress sites using the User Feedback plugin versions up to 1.0.15 are affected.
💻 Affected Systems
- User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds WordPress Plugin
📦 What is this software?
Userfeedback by Monsterinsights
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as administrators, deface websites, or install backdoors for persistent access.
Likely Case
Attackers inject malicious scripts to steal administrator credentials or session tokens, potentially gaining full control of the WordPress site.
If Mitigated
With proper input validation and output escaping, malicious scripts are neutralized before execution, preventing any impact.
🎯 Exploit Status
The vulnerability requires no authentication and exploitation is straightforward via form submissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.16 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/userfeedback-lite/tags/1.0.16/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'User Feedback' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.0.16+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate userfeedback-lite
Remove Plugin
allCompletely remove the vulnerable plugin
wp plugin delete userfeedback-lite
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Restrict access to WordPress admin panel to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'User Feedback' plugin version. If version is 1.0.15 or earlier, you are vulnerable.Check Version:
wp plugin get userfeedback-lite --field=versionVerify Fix Applied:
After updating, verify plugin version shows 1.0.16 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to feedback form endpoints with script tags in parameters
- Multiple form submissions from same IP with encoded payloads
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in name parameter values
- Unusual traffic to /wp-content/plugins/userfeedback-lite/ endpoints
SIEM Query:
source="wordpress.log" AND ("userfeedback" OR "name=" AND ("<script" OR "javascript:"))🔗 References
- https://plugins.trac.wordpress.org/browser/userfeedback-lite/tags/1.0.15/includes/frontend/class-userfeedback-frontend.php#L257
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bce9ba42-f574-47c1-9ea5-1e56f9da8e71?source=cve
- https://plugins.trac.wordpress.org/browser/userfeedback-lite/tags/1.0.15/includes/frontend/class-userfeedback-frontend.php#L257
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bce9ba42-f574-47c1-9ea5-1e56f9da8e71?source=cve
