CVE-2024-10232

Vulnerability

Overview

The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5. The flaw resides in the plugin's atomchat shortcode, where user-supplied attributes are not properly sanitized or escaped before being output. This insufficient input validation allows malicious JavaScript to be stored in the database and executed when a page containing the shortcode is visited [1].

Exploitation

Conditions

An authenticated attacker with at least contributor-level access can exploit this vulnerability by injecting arbitrary web scripts into the shortcode attributes. The attack does not require any special network position or additional privileges beyond those of a contributor. The injected script will execute in the context of any user who views the affected page, including administrators [1].

Impact

Successful exploitation leads to Stored XSS, enabling the attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the WordPress site. Since the script executes on every page load for all visitors, the potential for widespread compromise is significant, especially if an administrator visits the infected page [1].

Mitigation

The vendor has not released a patched version as of the disclosure date. Users are advised to disable the plugin until a fix is made available, or apply strict content security policies to mitigate script execution. There are no known workarounds within the plugin itself [1].