CVE-2024-25093: GD Rating System Stored XSS Vulnerability

CVE-2024-25093 Overview

CVE-2024-25093 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Milan Petrovic GD Rating System plugin for WordPress. The flaw affects all versions of the plugin up to and including 3.5. Attackers can inject malicious scripts that persist in the application and execute in the browsers of users who view affected pages. The Patchstack advisory classifies the issue as unauthenticated, meaning attackers do not need valid credentials to submit the malicious payload. Successful exploitation requires a victim to interact with the compromised page.

Critical Impact

Unauthenticated attackers can store JavaScript payloads that execute in visitor browsers, enabling session theft, phishing redirects, and administrative account takeover on WordPress sites running the affected plugin.

Affected Products

• Dev4press GD Rating System plugin for WordPress, versions n/a through 3.5
• WordPress sites with the gd-rating-system plugin enabled
• Any site permitting unauthenticated visitor input to rating functionality

Discovery Timeline

• 2024-02-29 - CVE-2024-25093 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25093

Vulnerability Analysis

The GD Rating System plugin fails to properly neutralize user-supplied input before rendering it in generated web pages. This is a classic stored XSS pattern under [CWE-79], where attacker-controlled content is persisted server-side and later reflected without adequate sanitization or output encoding. Because the vulnerability is exploitable without authentication, any anonymous visitor can submit a crafted payload. The stored script executes in the security context of the WordPress origin whenever the injected content is rendered.

Root Cause

The plugin does not enforce sufficient input validation on data submitted through its rating interfaces. Output routines emit stored values into HTML without contextual escaping, allowing raw <script> tags and event handler attributes to reach the browser. The scope change indicated in the vulnerability metadata reflects that injected script executes in a security context beyond that of the vulnerable component, affecting logged-in administrators who view the content.

Attack Vector

Exploitation occurs over the network. An attacker submits crafted input containing JavaScript through a plugin endpoint that stores rating-related data. When an administrator or visitor loads a page that renders the poisoned data, the payload executes in their browser. Consequences include session cookie theft, forced actions via the WordPress REST API, drive-by redirects, and injection of persistent backdoors when an administrator triggers the payload. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-25093

Indicators of Compromise

• Unexpected <script>, onerror=, or onload= strings stored in WordPress database tables associated with the gd-rating-system plugin
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading plugin-rendered pages
• New or modified WordPress administrator accounts and unexpected plugin installations following visits to rating pages
• Web server access logs showing POST requests to plugin endpoints containing URL-encoded HTML or JavaScript payloads

Detection Strategies

• Inspect stored plugin data for HTML tags and JavaScript event handlers using database queries against rating-related tables
• Deploy a Web Application Firewall (WAF) rule that flags requests to gd-rating-system endpoints containing <script, javascript:, or common XSS keywords
• Correlate anonymous POST activity with subsequent administrator sessions that trigger unusual WordPress REST API calls

Monitoring Recommendations

• Enable request body logging on WordPress reverse proxies to retain evidence of injection attempts
• Alert on modifications to WordPress user roles, wp_options, or plugin files immediately after page views by administrators
• Monitor browser Content Security Policy (CSP) violation reports to surface script execution from unexpected origins

How to Mitigate CVE-2024-25093

Immediate Actions Required

• Upgrade the GD Rating System plugin to a version later than 3.5 as published by the vendor
• If no fixed version is available, deactivate and remove the plugin until a patch is confirmed
• Audit stored rating data for existing script payloads and purge malicious entries
• Rotate WordPress administrator passwords and invalidate active sessions if administrators loaded rating pages during the exposure window

Patch Information

Refer to the Patchstack Vulnerability Report for current fix status. The advisory identifies version 3.5 and earlier as affected. Verify the installed version in the WordPress plugin manager and apply vendor updates as they become available.

Workarounds

• Deploy a WAF ruleset that blocks HTML tags and JavaScript keywords in requests targeting plugin endpoints
• Enforce a strict Content Security Policy that disallows inline scripts on pages rendering rating content
• Restrict access to rating submission endpoints to authenticated users via a WordPress access control plugin
• Disable the plugin on sites that do not actively require rating functionality

# Example CSP header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"