CVE-2024-12506

Vulnerability

The NACC WordPress Plugin up to and including version 4.1.0 is vulnerable to Stored Cross-Site Scripting (XSS) through the nacc shortcode. The plugin fails to properly sanitize user-supplied attributes and escape output before rendering shortcode parameters such as Theme, Language, Layout, and Show Special Keytags [1][2][3][4]. This allows malicious script injection into pages that use the shortcode.

Exploitation

An attacker must have at least Contributor-level access to a WordPress site running the vulnerable plugin. By inserting the nacc shortcode with crafted attribute values (e.g., [nacc Theme=""]), the payload is stored in the page content. When any user, including administrators, views the affected page, the injected script executes in their browser. No additional user interaction beyond page access is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of sensitive information (e.g., cookies, session tokens), defacement of the site, or redirection to malicious domains. The attack is persistent, affecting all subsequent visitors to the page.

Mitigation

As of the publication date (2024-12-20), no patched version has been released. The vendor has not provided an official update or workaround. Site administrators should disable or remove the plugin until a fix is available, and restrict contributor-level access to trusted users only. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.