CVE-2024-4895

Vulnerability

The wpDataTables plugin for WordPress versions up to and including 3.4.2.12 is vulnerable to Stored Cross-Site Scripting (XSS) via the CSV import functionality. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious CSV file containing XSS payloads and importing it through the plugin's CSV import feature. The injected script is stored and executed whenever a user accesses the affected page, such as a table rendered by the plugin [1].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's browser. This can lead to session hijacking, website defacement, or theft of sensitive information. The attack requires no authentication and affects any page displaying the imported table [1].

Mitigation

The vulnerability is fixed in version 3.4.2.13 and later versions. Users are strongly advised to update to the latest version (6.5.0.7 as of the reference) to mitigate the risk. No workarounds are documented, and the CVE is not currently listed in the CISA KEV catalog [1].