CVE-2024-5647

Root

Cause The vulnerability resides in the bundled Magnific Popup library (version 1.1.0) used by multiple WordPress plugins including Divi and Extra [1][2][3]. Insufficient input sanitization and output escaping on user-supplied attributes allowed the injection of arbitrary HTML and JavaScript into popup template fields such as image titles and status indicators [4].

Attack

Vector An authenticated attacker with contributor-level access or higher could craft malicious content within attributes processed by the Magnific Popup library [1][2][3]. When a victim (including other users or visitors) views a page containing this injected content, the stored script executes in their browser. No additional authentication beyond a contributor role is required.

Impact

Successful exploitation leads to stored cross-site scripting (XSS), enabling the attacker to execute arbitrary web scripts in the context of the victim's session. This can result in session hijacking, defacement, theft of sensitive data, or redirection to malicious sites.

Mitigation

The upstream library fixed the issue in version 1.2.0 by disabling HTML rendering in certain fields by default (new options allowHTMLInStatusIndicator and allowHTMLInTemplate are disabled by default) [4]. The Divi, Extra, and Divi Builder plugins were patched starting in version 4.27.2 (updated October 1, 2024), which updated Magnific Popup to v1.2.0 [1][2][3]. Users should update to the latest versions of these plugins to remediate the vulnerability.