CVE-2024-12591

Overview

The MagicPost plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via its wb_share_social shortcode. This flaw affects all versions up to and including 1.2.1 [1]. The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the shortcode.

Exploitation

An authenticated attacker with contributor-level access or higher can craft a shortcode with malicious JavaScript payloads in the attributes. When a post containing the shortcode is viewed by any user, the injected script executes in the context of the victim's browser.

Impact

Successful exploitation enables the attacker to perform a variety of malicious actions, such as stealing session cookies, redirecting users to phishing sites, or defacing the page. Since the attack is stored, every visitor to the affected post is at risk.

Mitigation

Users should update the plugin to a version newer than 1.2.1 as soon as it becomes available. As a temporary workaround, consider disabling the wb_share_social shortcode or restricting contributor-level permissions.