CVE-2024-37950

Vulnerability

Overview CVE-2024-37950 is a stored cross-site scripting (XSS) vulnerability in the Master Popups plugin for WordPress, affecting versions up to 1.0.3. The issue stems from improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary HTML and JavaScript code that is stored and later executed when other users visit the affected site [1].

Exploitation

Details Exploitation requires a privileged user (e.g., an administrator) to perform an action such as clicking a malicious link or submitting a crafted form. This vulnerability is actively used in mass-exploit campaigns targeting thousands of websites, regardless of their traffic or popularity [1]. The attack does not require authentication from the victim beyond the initial privileged interaction.

Impact

Successful exploitation enables an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads. These scripts execute in the context of the victim's browser when they visit the compromised site, potentially leading to data theft, defacement, or further compromise [1].

Mitigation

As an immediate action, users should update the Master Popups plugin to a patched version. If updating is not possible, it is recommended to contact the hosting provider or a web developer for assistance. No workarounds are provided in the advisory [1].