CVE-2024-13515: WordPress Image Source Control XSS Flaw

CVE-2024-13515 Overview

CVE-2024-13515 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Image Source Control Lite – Show Image Credits and Captions plugin for WordPress. The flaw affects all versions up to and including 2.28.0. It stems from insufficient input sanitization and output escaping on the path parameter processed by the plugin's caption preview template. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The issue is classified under CWE-79.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browser of a targeted WordPress user, potentially leading to session theft, credential harvesting, or administrative action abuse.

Affected Products

Image Source Control Lite – Show Image Credits and Captions plugin for WordPress
All plugin versions up to and including 2.28.0
WordPress sites using the vulnerable caption-preview.html template

Discovery Timeline

2025-01-18 - CVE-2024-13515 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-13515

Vulnerability Analysis

The vulnerability resides in the plugin's settings preview functionality. The admin settings script constructs an iframe URL for admin/templates/settings/preview/caption-preview.html and appends a path query parameter. The preview template reads that path value directly from window.location.search and uses it to build the src attribute of a dynamically created <script> element. Because the value is not sanitized or validated, an attacker who convinces an authenticated user to visit a crafted URL can force the browser to load and execute attacker-controlled JavaScript in the WordPress administrative context.

Exploitation requires user interaction, which aligns with a reflected XSS pattern. Injected scripts run under the origin of the targeted WordPress site, so an attacker can pivot to actions such as reading nonces, altering plugin configuration, or exfiltrating cookies not protected by HttpOnly.

Root Cause

The root cause is unvalidated use of a user-controlled query parameter to construct a script src. The template treated the path parameter as trustworthy and concatenated it into script.src, effectively allowing arbitrary remote script inclusion or javascript: URI abuse.

Attack Vector

The attack vector is network-based via a crafted URL delivered through phishing, forum posts, or malicious links. When the victim clicks the link, the vulnerable preview template loads the attacker-controlled script.

javascript

// Patch: admin/assets/js/settings.js
// Before (vulnerable): the 'path' parameter was reflected into the iframe URL
// iframe.src = isc_settings.baseurl + 'admin/templates/settings/preview/caption-preview.html'
//     + "?path=" + encodeURIComponent(isc_settings.baseurl)
//     + "&position=" + $(this).data('position')
//     + "&pretext=" + encodeURIComponent($('#source-pretext').val());

// After (patched): the 'path' parameter is removed entirely
iframe.src = isc_settings.baseurl
    + 'admin/templates/settings/preview/caption-preview.html'
    + "?position=" + $(this).data('position')
    + "&pretext=" + encodeURIComponent($('#source-pretext').val());
iframe.width = "250";
iframe.height = "181";

Source: GitHub commit d1461b8

text

<!-- Patch: admin/templates/settings/preview/caption-preview.html -->
<!-- Before (vulnerable): script src was built from the untrusted 'path' query parameter -->
<!-- var path = urlParams.get('path'); -->
<!-- script.src = path + 'public/assets/js/captions.js'; -->

<!-- After (patched): script src uses a hardcoded relative path -->
var script = document.createElement('script');
script.src = './../../../../public/assets/js/captions.js';
document.head.appendChild(script);

Source: GitHub commit d1461b8

Detection Methods for CVE-2024-13515

Indicators of Compromise

Web server access logs containing requests to admin/templates/settings/preview/caption-preview.html with a path= query parameter pointing to an external host or containing URL-encoded script payloads.
Referer headers showing users arriving at the preview template from external, non-admin origins.
Content Security Policy (CSP) violation reports referencing script loads from untrusted domains on WordPress admin paths.

Detection Strategies

Inspect HTTP request logs for the path parameter on the plugin's preview endpoint and flag values that are absolute URLs, contain javascript:, or include encoded angle brackets.
Correlate outbound browser requests from administrator sessions to untrusted domains immediately after clicking inbound links.
Compare installed Image Source Control plugin versions against version 2.28.0 to identify vulnerable hosts.

Monitoring Recommendations

Enable and centrally collect WordPress admin access logs, including full query strings, to support retrospective hunting.
Deploy a Web Application Firewall (WAF) rule that inspects and blocks suspicious values in the path parameter for the plugin's preview template.
Monitor for anomalous administrator activity following external link clicks, such as unexpected option changes or new user creation.

How to Mitigate CVE-2024-13515

Immediate Actions Required

Update the Image Source Control Lite plugin to a version later than 2.28.0 on all WordPress instances.
Audit administrator accounts and rotate credentials if suspicious path parameter requests appear in historical logs.
Remind privileged users to avoid clicking untrusted links while authenticated to the WordPress admin panel.

Patch Information

The vendor removed the untrusted path parameter and replaced the dynamic script source with a hardcoded relative path. The fix is applied in both admin/assets/js/settings.js and admin/templates/settings/preview/caption-preview.html. Refer to the GitHub commit, WordPress Plugin Changeset #3172639, WordPress Plugin Changeset #3188412, and the Wordfence Vulnerability Report for full remediation details.

Workarounds

Temporarily deactivate the Image Source Control Lite plugin until it can be updated.
Configure a WAF rule that strips or blocks the path query parameter on requests to the plugin's caption-preview.html template.
Enforce a strict Content Security Policy on WordPress admin pages to restrict script sources to trusted origins.

bash

# Example WAF rule (ModSecurity) to block external 'path' values on the preview endpoint
SecRule REQUEST_URI "@contains /image-source-control-isc/admin/templates/settings/preview/caption-preview.html" \
    "chain,phase:2,deny,status:403,id:1013515,msg:'Block CVE-2024-13515 XSS attempt via path parameter'"
    SecRule ARGS:path "@rx ^(https?:|javascript:|//|.*<)" "t:lowercase,t:urlDecodeUni"