Loading vulnerability…
Stored Cross-Site Scripting in WP Statistics URL Search Parameter
CVE-2024-2194 is a stored cross-site scripting vulnerability in the WP Statistics plugin for WordPress affecting all versions up to and including 14.5. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary JavaScript through a URL search parameter. Exploitation attempts use the utm_id parameter to store malicious payloads that execute when a user accesses an affected page. Execution in a privileged user's browser can enable unauthorized administrative actions and persistent website compromise.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Injected JavaScript executes in the browser of a user viewing an affected page. When the viewer has administrative privileges, malicious scripts can perform privileged WordPress operations. Observed payloads used in campaigns targeting this vulnerability and two other WordPress stored XSS vulnerabilities create administrator accounts, inject PHP backdoors into plugin and theme files, and track compromised websites.
If you can’t patch tonight, do this now.
Review administrator accounts, plugin directories, and theme and plugin files for unauthorized additions or modifications. Investigate injected external script references and unexpected outbound tracking requests, and remove suspicious plugin directories after investigation. These measures support detection and cleanup but do not replace fixing the vulnerable plugin.
Patch, then assume compromise.
Update WP Statistics to a vendor release that fixes CVE-2024-2194. Versions through 14.5 are affected; the exact first fixed version is not specified in the available information. For potentially compromised installations, investigate unauthorized administrator accounts and unexpected plugin or theme modifications, remove malicious code and accounts, and review other installed plugins for necessary security updates.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.