CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-8680

High Severity
Ibericode
SVRS
54/100
CVSSv3
5.5/10
EPSS
0.00026/1

CVE-2024-8680 is a Stored Cross-Site Scripting (XSS) vulnerability in the MC4WP: Mailchimp for WordPress plugin. This flaw allows attackers with administrator privileges to inject malicious web scripts into website pages. While the CVSS score is 5.5, the SOCRadar Vulnerability Risk Score (SVRS) is 54, indicating a moderate risk. This vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled. Exploitation can lead to arbitrary code execution in a user's browser when they visit the compromised page, enabling attackers to steal credentials, deface websites, or redirect users to malicious sites. Although not considered critical based on the SVRS, immediate patching is recommended to prevent potential security breaches and maintain the integrity of WordPress websites using the vulnerable plugin. The significance of this CVE lies in the potential for widespread compromise across affected WordPress instances.

TAGS
No tags available
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:H
UI:N
S:C
C:L
I:L
A:N
PUBLICATION DATE2024-09-21
LAST MODIFIED2024-09-27
Eye Icon
SOCRadar
AI Insight

Description:

CVE-2024-8680 is a Stored Cross-Site Scripting (XSS) vulnerability in the MC4WP: Mailchimp for WordPress plugin for WordPress. It allows authenticated attackers with administrator-level permissions to inject malicious scripts into pages, which will execute when users access those pages. This vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled.

Key Insights:

  • SVRS Score: 38 (Moderate)
  • Exploit Status: Active exploits have been published.
  • CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
  • In the Wild: The vulnerability is actively exploited by hackers.

Mitigation Strategies:

  • Update the MC4WP: Mailchimp for WordPress plugin to version 4.9.17 or later.
  • Disable the unfiltered_html option in the plugin settings.
  • Implement input sanitization and output escaping measures to prevent XSS attacks.
  • Regularly monitor for suspicious activity and apply security patches promptly.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-8680 | MailChimp Plugin up to 4.9.16 on WordPress cross site scripting
vuldb.com2025-03-09
CVE-2024-8680 | MailChimp Plugin up to 4.9.16 on WordPress cross site scripting | A vulnerability was found in MailChimp Plugin up to 4.9.16 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-8680. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com
rss
forum
news

Social Media

CVE-2024-8680 The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due… https://t.co/gMcvsmUyac
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppIbericodemailchimp

References

ReferenceLink
[email protected]https://github.com/ibericode/mailchimp-for-wordpress/blob/main/includes/views/parts/lists-overview-details.php
[email protected]https://github.com/ibericode/mailchimp-for-wordpress/commit/60c6bfc260a7974f791af1d4ad4a032a3e0bdd3c
[email protected]https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/trunk/includes/views/parts/lists-overview-details.php
[email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3153075%40mailchimp-for-wp%2Ftrunk&old=3149806%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail=
[email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/aa464547-0380-4b91-a5ea-0cd9a66da7a7?source=cve

CWE Details

CWE IDCWE NameDescription
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence