CVE-2024-11974: Media Library Assistant XSS Vulnerability

CVE-2024-11974 Overview

The Media Library Assistant plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.23. The flaw resides in the smc_settings_tab, unattachfixit-action, and woofixit-action parameters, which lack sufficient input sanitization and output escaping. Unauthenticated attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser when the link is clicked. Successful exploitation runs in the context of the targeted user's session, enabling actions such as session token theft, administrative action forgery, or redirection to attacker-controlled infrastructure. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in an administrator's browser via crafted links, enabling account takeover of WordPress sites running Media Library Assistant 3.23 or earlier.

Affected Products

Davidlingren Media Library Assistant plugin for WordPress, versions up to and including 3.23
WordPress installations running the vulnerable plugin with the Smart Media Categories, Unattached Fixit, or WooFixit example modules
Any WordPress site where administrators can be socially engineered into clicking crafted links

Discovery Timeline

2025-01-04 - CVE-2024-11974 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11974

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in three example plugin modules bundled with Media Library Assistant. User-controlled values from the smc_settings_tab, unattachfixit-action, and woofixit-action request parameters are echoed back into administrative HTML output without proper escaping. Because the injected content is rendered in the same origin as the WordPress admin interface, attacker-supplied JavaScript executes with the privileges of the authenticated victim. Exploitation requires user interaction — typically clicking a phishing link — but no authentication on the attacker's part.

Root Cause

The root cause is missing input sanitization and output escaping in the affected parameter handlers. The vulnerable code paths reside in mla-unattached-fixit.php, class-smc-settings-support.php, and woofixit.php. Each handler renders request parameters into the admin page markup without applying esc_attr(), esc_html(), or similar WordPress escaping helpers.

Attack Vector

An attacker crafts a URL pointing to the target WordPress admin page with a malicious payload in one of the three vulnerable parameters. The attacker delivers the link through phishing email, forum posts, or malicious advertising. When an authenticated administrator clicks the link, the injected script executes in their browser session. Payloads can steal authentication cookies, create rogue administrator accounts through the REST API, or modify site content. See the Wordfence Vulnerability Report for additional technical details.

// No verified proof-of-concept code is publicly available.
// The vulnerable parameters (smc_settings_tab, unattachfixit-action,
// woofixit-action) are reflected into admin page HTML without escaping.
// Refer to the linked source files above for the exact sink locations.

Detection Methods for CVE-2024-11974

Indicators of Compromise

HTTP requests to WordPress admin endpoints containing smc_settings_tab, unattachfixit-action, or woofixit-action parameters with <script>, javascript:, onerror=, or URL-encoded angle brackets
Referrer headers pointing to external domains preceding admin requests with the affected parameter names
Creation of unexpected administrator accounts or modifications to user roles following administrator sessions
Outbound requests from browser sessions to unknown domains shortly after admin panel access

Detection Strategies

Inspect web server access logs for query strings targeting the three vulnerable parameters with script-like payloads or encoded HTML entities
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns on WordPress admin routes
Monitor WordPress audit logs for new user creation, role escalation, or plugin installation events without corresponding authorized administrator activity

Monitoring Recommendations

Enable verbose logging on the WordPress admin interface and forward logs to a centralized SIEM for correlation
Alert on anomalous administrator behavior originating from unusual IP addresses or user agents
Track plugin version inventory across WordPress installations and flag any host still running Media Library Assistant 3.23 or earlier

How to Mitigate CVE-2024-11974

Immediate Actions Required

Update the Media Library Assistant plugin to a version newer than 3.23 that includes the fix from changeset #3215759
Audit administrator accounts and revoke any unfamiliar users or sessions created during the exposure window
Force password resets and invalidate active sessions for privileged WordPress users

Patch Information

The vendor addressed the vulnerability in WordPress Changeset #3215759, which adds proper input sanitization and output escaping to the affected parameter handlers. Site administrators should upgrade to the latest release published on the Media Library Assistant plugin page.

Workarounds

Deactivate the Media Library Assistant plugin until the patched version can be installed
Remove the vulnerable example modules (mla-unattached-fixit.php, smart-media-categories, woofixit.php) from the plugin's examples/plugins/ directory if they are not required
Deploy WAF rules that block requests containing script tags or JavaScript event handlers in the smc_settings_tab, unattachfixit-action, and woofixit-action parameters
Enforce strict Content Security Policy (CSP) headers on the WordPress admin interface to restrict inline script execution

bash

# Example WAF rule (ModSecurity syntax) to block XSS payloads
# targeting the vulnerable parameters
SecRule ARGS:smc_settings_tab|ARGS:unattachfixit-action|ARGS:woofixit-action \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe)" \
    "id:1002024,phase:2,deny,status:403,\
    msg:'CVE-2024-11974 Media Library Assistant XSS attempt'"