CVE-2024-34553: Stockholm Core XSS Vulnerability

CVE-2024-34553 Overview

CVE-2024-34553 is a reflected cross-site scripting (XSS) vulnerability in the Select-Themes Stockholm Core plugin for WordPress. The flaw affects all versions from unspecified initial releases through 2.4.1. It stems from improper neutralization of user-controlled input during web page generation, classified under [CWE-79]. An attacker can craft a malicious URL that injects JavaScript into the response rendered by a vulnerable site. Successful exploitation requires user interaction, such as clicking a crafted link. The vulnerability enables session compromise, credential theft, and unauthorized actions in the browser context of the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, potentially hijacking authenticated WordPress sessions and pivoting to administrative accounts.

Affected Products

Select-Themes Stockholm Core plugin for WordPress
All versions from initial release through 2.4.1
WordPress sites bundling the Stockholm Core plugin as part of the Stockholm theme

Discovery Timeline

2024-05-08 - CVE-2024-34553 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34553

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Stockholm Core plugin. Reflected XSS occurs when an application returns unsanitized user input directly in the HTTP response. In this case, the plugin echoes request parameters into rendered HTML without applying proper output encoding or input validation. An attacker crafts a URL containing JavaScript payloads and delivers it through phishing, malicious advertising, or social engineering channels. When a visitor clicks the link, the payload executes in the browser under the origin of the vulnerable WordPress site. The scope change indicated by the vulnerability metrics reflects the ability to affect resources beyond the vulnerable component, such as data in other browser contexts.

Root Cause

The root cause is missing or insufficient output encoding on request-derived data before insertion into HTML. The plugin fails to apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to reflected parameters. This allows attacker-controlled markup and script tags to be rendered by the browser as executable content.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker must convince a target to interact with a crafted link. Once the victim visits the malicious URL, the injected script runs in the context of the WordPress site. The payload can read cookies, manipulate the DOM, submit authenticated requests, or exfiltrate sensitive data to attacker infrastructure. Administrators viewing the payload are of highest concern because their session cookies enable full site takeover.

No verified public proof-of-concept code is available for this issue. Refer to the Patchstack Vulnerability Advisory for further technical context.

Detection Methods for CVE-2024-34553

Indicators of Compromise

Web server access logs containing URL parameters with <script>, javascript:, onerror=, or encoded variants such as %3Cscript%3E
Unexpected outbound requests from browsers loading Stockholm-themed pages to unknown domains
WordPress administrator sessions originating from unusual IP addresses or geolocations following link clicks
Presence of Stockholm Core plugin version 2.4.1 or earlier on WordPress installations

Detection Strategies

Inspect HTTP request and response pairs served by WordPress for reflected script content matching request parameters
Deploy a web application firewall (WAF) rule set that flags XSS signatures targeting WordPress query strings
Correlate referrer headers pointing to external phishing domains with subsequent authenticated admin activity
Scan installed WordPress plugins across the estate to identify vulnerable Stockholm Core versions

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy and retain logs for at least 90 days
Monitor Content Security Policy (CSP) violation reports for inline script execution attempts
Alert on new administrator account creation, plugin installation, or theme modification events
Track browser telemetry from endpoint agents for anomalous script execution on WordPress admin pages

How to Mitigate CVE-2024-34553

Immediate Actions Required

Identify all WordPress sites running the Stockholm theme and enumerate the bundled Stockholm Core plugin version
Update Stockholm Core to a version later than 2.4.1 as soon as the vendor publishes a fixed release
Invalidate active administrator sessions and force password rotation for privileged WordPress accounts
Deploy a Content Security Policy that restricts inline scripts and limits allowed script sources

Patch Information

The vulnerability affects Stockholm Core through version 2.4.1. Consult the Patchstack Vulnerability Advisory for the current fixed version and vendor guidance. Apply the patched release through the WordPress plugin update mechanism or via the Stockholm theme update channel.

Workarounds

Deploy a WAF rule blocking requests containing common XSS payload patterns targeting Stockholm plugin endpoints
Disable or remove the Stockholm Core plugin on sites where the affected functionality is not required
Restrict administrator access to trusted IP ranges through server-level access controls
Educate site administrators to avoid clicking untrusted links while authenticated to WordPress

bash

# Example nginx rule blocking script tags in query strings for Stockholm endpoints
location ~* /wp-content/plugins/stockholm-core/ {
    if ($args ~* "(<|%3C)script") {
        return 403;
    }
}