actively-exploited-vulnerabilityinternet-facing-service-vulnerabilitypersistence-methodinitial-access-method

WordPress Plugin Stored XSS Attacks Create Rogue Admin Accounts and Deploy Backdoors

Active Exploitation · 2 sources · Updated 1mo ago · First seen Apr 16, 2024

Attackers targeted unauthenticated stored cross-site scripting vulnerabilities in three WordPress plugins: WP Statistics (CVE-2024-2194), WP Meta SEO (CVE-2023-6961), and LiteSpeed Cache (CVE-2023-40000). Malicious JavaScript injected into affected sites executes when a privileged user views the compromised content, enabling creation of administrator accounts, installation of PHP backdoors, and tracking of infected websites. Fastly reported more than 5 billion exploitation requests against WP Meta SEO from one IP address and LiteSpeed Cache attacks from 1,664 distinct IP addresses, with substantial activity linked to IP Volume Inc. and Telkom Internet LTD infrastructure.

WPScan separately documented infections associated with LiteSpeed Cache versions earlier than 5.7.0.1, including modifications to WordPress files and database entries, rogue accounts named wpsupp-user and wp-configuser, and remote infrastructure at startservicefounds.com and cloudswiftcdn.com. Scanning activity was heavily associated with 94.102.51.144 and 31.43.191.220. Defenders should update affected plugins to patched versions, remove suspicious components, investigate unexpected administrator accounts and file changes, and inspect the litespeed.admin_display.messages database option for obfuscated JavaScript. Reviewing malicious script references and outbound tracking requests can help identify compromises that require cleanup beyond patching.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

9 events · Feb 2024 – Apr 16, 2024

Reported Dec 6, 20242y ago
Fastly reveals large-scale exploitation of three WordPress stored XSS flaws
Fastly reported active exploitation of CVE-2024-2194, CVE-2023-6961, and CVE-2023-40000 using identical obfuscated JavaScript that creates administrator accounts, installs PHP backdoors, and tracks infected sites. Its observations included more than 5 billion WP Meta SEO exploitation requests from one IP address and LiteSpeed Cache attacks from 1,664 distinct IP addresses.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly
Reported Dec 6, 20242y ago
WP Meta SEO attacks begin reusing a domain seen in WP Statistics exploitation
Fastly observed media.cdnstaticjs[.]com in CVE-2023-6961 attack payloads beginning May 16. The domain was also used in CVE-2024-2194 exploitation, linking the infrastructure across the two targeted plugins.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly
Reported Dec 6, 20242y ago
LiteSpeed Cache attacks stop using cdn.mediajsdelivery[.]com
Fastly recorded the last observed use of cdn.mediajsdelivery[.]com in CVE-2023-40000 payloads on April 15. Subsequent observed payloads for that vulnerability used cloud.cdndynamic[.]com and go.kcloudinc[.]com instead.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly
Reported May 3, 20243y ago
WPScan identifies WordPress infections linked to vulnerable LiteSpeed Cache versions
WPScan reported infections involving malicious code in WordPress files and database entries, including the litespeed.admin_display.messages option, and rogue administrator accounts such as wpsupp-user and wp-configuser. The malware used infrastructure including startservicefounds.com and cache.cloudswiftcdn.com.
Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin | WPScan
Reported May 3, 20243y ago
LiteSpeed Cache scanning activity spikes again
WPScan's WAF telemetry showed the access spike resurfacing on April 27, indicating renewed scanning activity associated with vulnerable LiteSpeed Cache installations.
Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin | WPScan
Reported May 3, 20243y ago
WAF telemetry records a spike in requests targeting vulnerable LiteSpeed Cache sites
WPScan reported an unusual peak in access to the relevant attack URL on April 2. Its cited WAF logs identified 94.102.51.144 and 31.43.191.220 as probable scanners, generating 1,232,810 and 70,472 requests respectively during the observation period.
Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin | WPScan
Apr 16, 20243y ago
CERT PL researcher discloses stored XSS vulnerability in WP Meta SEO
Krzysztof Zając of CERT PL disclosed CVE-2023-6961, affecting WP Meta SEO version 4.5.12 and earlier. A malicious Referer header can be stored during redirect tracking and execute when an administrator opens the 404 & Redirects page.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly
Mar 11, 20243y ago
Tim Coen discloses stored XSS vulnerability in WP Statistics
Tim Coen disclosed CVE-2024-2194, affecting WP Statistics version 14.5 and earlier. The vulnerability permits unauthenticated script injection through a URL search parameter.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly
Feb 2024
Patchstack discloses stored XSS vulnerability in LiteSpeed Cache
Patchstack disclosed CVE-2023-40000, an unauthenticated stored cross-site scripting vulnerability affecting LiteSpeed Cache version 5.7.0.1 and earlier. Attackers can inject scripts through the nameservers and _msg parameters that execute when an administrator accesses a backend page.
WordPress Stored XSS Vulnerabilities Under Attack | Fastly

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

3 linked

Unauthenticated stored XSS in LiteSpeed Cache for WordPress (CVE-2023-40000)Stored Cross-Site Scripting in WP Statistics URL Search Parameter (CVE-2024-2194)Stored XSS in WP Meta SEO via the Referer Header (CVE-2023-6961)

Affected products

3 linked

Wp Meta SeoLitespeed CacheWp Statistics

Observables

34 linked

IPv4 address•••.••.•••.•••Domain•••••••.ruURLhttps://•••••••.•••/••••••Email address•••••••@••••••••.•••IPv4 address•••.••.•••.•••Domain•••••••••••.ruURLhttps://•••••.•••/••••••IPv4 address•••.•••.••.•••+26

Indicator values are masked on this page. View all 34 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

FastlyNews · Dec 6, 2024

WordPress Stored XSS Vulnerabilities Under Attack | FastlyOpen source ↗

Wpscan BlogNews · May 3, 2024

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin | WPScanOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News