CVE-2024-3615: Media Library Folders XSS Vulnerability

CVE-2024-3615 Overview

The Media Library Folders plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the s parameter. The flaw affects all versions up to and including 8.2.0. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Successful exploitation requires user interaction, such as clicking a crafted link. When triggered, injected scripts execute in the victim's browser context on the vulnerable WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an authenticated user's browser session, enabling session theft, credential capture, and administrative action hijacking on affected WordPress sites.

Affected Products

Maxfoundry Media Library Folders plugin for WordPress (all versions ≤ 8.2.0)
WordPress sites with the vulnerable plugin installed and active
Any WordPress environment exposing the plugin's search functionality to unauthenticated users

Discovery Timeline

2024-04-19 - CVE-2024-3615 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3615

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) issue affecting the s (search) parameter processed by the Media Library Folders plugin. The plugin echoes user-supplied input from the s query parameter back into the HTML response without proper sanitization or output escaping. Because reflection occurs before rendering, attacker-controlled markup and script fragments become part of the DOM.

Exploitation requires a victim to load a crafted URL, typically delivered through phishing, forum posts, or malicious redirects. The attack executes in the browser session of the target user, inheriting their privileges on the WordPress site. When an administrator triggers the payload, the attacker can perform actions such as creating new admin accounts, modifying plugin settings, or injecting persistent backdoors through the admin interface.

Root Cause

The root cause is missing input sanitization on the s request parameter and missing output escaping when the value is rendered back to the response HTML. The plugin does not apply WordPress functions such as sanitize_text_field() on input or esc_html() / esc_attr() on output, allowing script tags and event handlers to survive into the rendered page.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing at a vulnerable WordPress endpoint with a malicious payload embedded in the s parameter. The attacker then delivers the link through email, chat, or a compromised web page. When the victim clicks the link while authenticated to the WordPress site, the injected script executes in their session context.

Because the CVSS scope is changed, injected code can access resources beyond the vulnerable component, including authenticated cookies and CSRF tokens tied to the WordPress admin panel.

No verified proof-of-concept code is publicly linked for this CVE. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-3615

Indicators of Compromise

HTTP requests containing script tags, javascript: URIs, or HTML event handlers (onerror=, onload=) in the s query parameter
Referer headers pointing to external domains preceding requests that include suspicious s parameter values
Unexpected WordPress administrator accounts, plugin changes, or theme modifications following suspicious admin sessions
Outbound requests from browsers to attacker-controlled domains immediately after clicking Media Library Folders search links

Detection Strategies

Inspect web server access logs for requests to Media Library Folders endpoints containing encoded or raw <script, %3Cscript, or onerror= substrings in the s parameter
Deploy a Web Application Firewall (WAF) rule to flag XSS patterns in query strings targeting /wp-admin/ and plugin routes
Enable Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on WordPress admin pages
Correlate authenticated administrator sessions with anomalous referer chains or short-lived sessions producing configuration changes

Monitoring Recommendations

Monitor WordPress plugin inventory to identify installations of Media Library Folders at or below version 8.2.0
Alert on new administrator account creation, user role changes, and plugin/theme file modifications
Log and review outbound HTTP requests from administrator workstations to newly registered or low-reputation domains

How to Mitigate CVE-2024-3615

Immediate Actions Required

Update the Media Library Folders plugin to the latest patched release above version 8.2.0 on all WordPress instances
Audit administrator accounts, active sessions, and recently modified plugin or theme files for unauthorized changes
Rotate WordPress administrator passwords and invalidate active sessions if suspicious search parameter activity is observed in logs
Enforce phishing-resistant multi-factor authentication (MFA) on all WordPress administrator accounts

Patch Information

The vendor addressed the issue in the WordPress plugin repository. Review the WordPress Plugin Changeset and the Wordfence Vulnerability Report for fix details, and upgrade to the version above 8.2.0.

Workarounds

Deactivate and remove the Media Library Folders plugin until an upgrade is completed if patching cannot be performed immediately
Configure a WAF rule to block requests containing script tags or HTML event handlers in the s query parameter
Deploy a strict Content Security Policy that disallows inline script execution on WordPress admin and plugin pages
Restrict access to WordPress administration paths by source IP or VPN to reduce exposure to unauthenticated attackers

bash

# Example ModSecurity rule to block XSS patterns in the 's' parameter
SecRule ARGS:s "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe)" \
    "id:1003615,phase:2,deny,status:403,\
    msg:'CVE-2024-3615 XSS attempt in Media Library Folders s parameter',\
    tag:'attack-xss',tag:'CVE-2024-3615'"