CVE-2024-3031

Vulnerability

The Fluid Notification Bar plugin for WordPress versions up to and including 3.2.3 is vulnerable to Stored Cross-Site Scripting (XSS) via its admin settings. The vulnerability arises from insufficient input sanitization and output escaping, allowing arbitrary script injection. This issue is exploitable only on multi-site installations or sites where the unfiltered_html capability has been disabled.

Exploitation

An authenticated attacker with administrator-level permissions (or higher) can inject arbitrary web scripts through the plugin's admin settings. Once saved, the injected script executes whenever any user accesses a page that includes the notification bar. No additional user interaction is required beyond normal page viewing.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information. The attacker gains the ability to compromise other users, including those with lower privileges, effectively escalating their control within the WordPress environment.

Mitigation

The plugin has been removed from the WordPress.org plugin directory as of May 31, 2024, due to a security issue [1]. No patched version is available. Users who have the plugin installed should uninstall it immediately. There is no known workaround; the only safe action is to remove the plugin entirely.