CVE-2024-13351 Overview
CVE-2024-13351 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Social proof testimonials and reviews by Repuso plugin for WordPress. The flaw exists in all versions up to and including 5.20. It stems from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's rw_image_badge1 shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any visitor that loads the affected page. The issue is tracked under CWE-79.
Critical Impact
Authenticated contributors can persist malicious scripts in WordPress pages, enabling session theft, account takeover, and arbitrary actions in the context of visiting administrators.
Affected Products
- Social proof testimonials and reviews by Repuso plugin for WordPress
- All versions up to and including 5.20
- WordPress sites permitting contributor-level (or higher) accounts
Discovery Timeline
- 2025-01-15 - CVE-2024-13351 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13351
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw in the rw_image_badge1 shortcode handler. The plugin accepts user-supplied attribute values passed to the shortcode and emits them into rendered HTML without sufficient sanitization or output escaping. Because shortcodes are processed server-side and stored within post content, the injected payload persists in the database. Any subsequent visitor to the rendered page triggers script execution in their browser session.
Exploitation requires authentication at contributor level or above. WordPress contributors can author drafts containing shortcodes, which makes the attack surface accessible to low-privilege accounts. A successful payload runs in the context of every user viewing the page, including editors and administrators reviewing submitted drafts. This enables session hijacking, forced administrative actions, and pivoting to broader site compromise.
Root Cause
The root cause is missing input sanitization and missing output escaping in the shortcode's attribute handling. The plugin does not apply WordPress core escaping functions such as esc_attr() or esc_html() to attribute values rendered into HTML. The patch addressed in changeset 3222107 introduces proper escaping.
Attack Vector
The attack vector is network-based and requires contributor-level authentication. An attacker authors a post or page containing the rw_image_badge1 shortcode with malicious JavaScript embedded in one of its attributes. When the page is rendered, the injected script executes in the visitor's browser. The scope is changed because script execution occurs in the security context of the WordPress site rather than the attacker.
No public proof-of-concept code has been published. See the Wordfence advisory for additional technical details.
Detection Methods for CVE-2024-13351
Indicators of Compromise
- Posts or pages containing rw_image_badge1 shortcodes with attribute values that include <script>, javascript:, onerror=, onload=, or HTML entity-encoded equivalents.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing plugin-rendered pages.
- New or modified WordPress administrator accounts created shortly after contributor-authored drafts are reviewed.
Detection Strategies
- Query the wp_posts table for post_content entries containing rw_image_badge1 and inspect attribute values for embedded HTML or JavaScript syntax.
- Audit contributor-level accounts and recent draft submissions for suspicious shortcode usage.
- Enable a Content Security Policy (CSP) in report-only mode to surface inline script violations on rendered pages.
Monitoring Recommendations
- Monitor WordPress access logs for repeated requests to pages authored by contributor accounts.
- Alert on plugin file modifications and on creation of new user accounts with elevated roles.
- Track browser-side errors and CSP violation reports originating from pages that embed the affected shortcode.
How to Mitigate CVE-2024-13351
Immediate Actions Required
- Update the Social proof testimonials and reviews by Repuso plugin to the version released after changeset 3222107.
- Review all existing posts and pages for instances of the rw_image_badge1 shortcode and remove any unexpected attribute content.
- Audit contributor and author accounts; remove inactive or untrusted users.
Patch Information
The vendor addressed the vulnerability in the WordPress plugin repository commit referenced in changeset 3222107. The fix applies output escaping to shortcode attributes. Site administrators should upgrade to the version published immediately after version 5.20.
Workarounds
- Deactivate the Social proof testimonials and reviews by Repuso plugin until the patched version is installed.
- Restrict contributor-level account provisioning and require editor review of all draft content before publication.
- Deploy a Web Application Firewall (WAF) rule that blocks shortcode attribute values containing <script>, on*= event handlers, and javascript: URIs.
- Enforce a strict Content Security Policy that disallows inline scripts on public pages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
