CVE-2024-49605 Overview
CVE-2024-49605 is a Cross-Site Request Forgery (CSRF) vulnerability in the Stefan Nour AVChat Video Chat WordPress plugin (avchat-3) that leads to Stored Cross-Site Scripting (XSS). The flaw affects all plugin versions up to and including 2.2. An attacker can craft a malicious page that, when visited by an authenticated administrator, submits a forged request storing arbitrary JavaScript in the plugin configuration. The injected script then executes in the browser of any user viewing the affected page.
Critical Impact
Successful exploitation allows an unauthenticated attacker to persist JavaScript in a WordPress site by tricking an authenticated user into visiting a malicious link, enabling session theft, redirection, or defacement.
Affected Products
- Stefan Nour AVChat Video Chat plugin for WordPress (avchat-3)
- All versions from n/a through 2.2
- WordPress installations with the plugin activated
Discovery Timeline
- 2024-10-20 - CVE-2024-49605 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49605
Vulnerability Analysis
The vulnerability chains two weaknesses. First, plugin actions that update settings do not verify a WordPress nonce or other anti-CSRF token, allowing off-site requests to succeed against an authenticated session. Second, the settings input is stored without adequate sanitization or output encoding, so attacker-supplied HTML and JavaScript are rendered in the browser when the page is loaded.
The attack requires user interaction: an authenticated administrator or privileged user must visit an attacker-controlled page while logged in to the target WordPress site. Because the payload is stored, the injected script executes whenever the affected plugin content is rendered, giving persistence beyond the initial CSRF request.
Root Cause
The root cause is missing CSRF protection [CWE-352] on state-changing plugin endpoints combined with insufficient input sanitization of values that are later reflected in HTML output. WordPress provides wp_nonce_field() and check_admin_referer() primitives that were not applied, and stored strings are not escaped with esc_html() or esc_attr() at render time.
Attack Vector
The attack vector is network-based and requires no privileges on the target site. An attacker hosts a page containing an auto-submitting form or fetch call targeting the plugin's settings endpoint. When a logged-in administrator loads that page, the browser sends session cookies with the forged request, the payload is persisted, and any subsequent page load executes the stored script in the victim's browser context.
For technical write-up details see the Patchstack Vulnerability Analysis.
Detection Methods for CVE-2024-49605
Indicators of Compromise
- Unexpected <script> tags, event handlers, or external JavaScript references stored in AVChat plugin options within the wp_options table.
- Administrator sessions issuing plugin settings updates immediately after visiting an external site referrer.
- Outbound requests from browsers of WordPress admins to unfamiliar domains shortly after loading plugin-rendered pages.
Detection Strategies
- Audit wp_options rows tied to the avchat-3 plugin for HTML or JavaScript content that should not be present in configuration fields.
- Enable WordPress activity logging to correlate settings changes with the originating HTTP Referer header and user agent.
- Deploy a web application firewall rule that flags POST requests to plugin admin endpoints lacking a valid _wpnonce parameter.
Monitoring Recommendations
- Monitor web server access logs for POST requests to /wp-admin/admin.php referencing the AVChat plugin from external referrers.
- Alert on new script execution or content security policy violations reported by browsers rendering WordPress admin pages.
- Track plugin version inventory across WordPress sites to identify installations still running avchat-3 version 2.2 or earlier.
How to Mitigate CVE-2024-49605
Immediate Actions Required
- Deactivate and remove the AVChat Video Chat plugin if no patched release above version 2.2 is available.
- Review plugin settings and remove any unexpected HTML or JavaScript stored in configuration fields.
- Force logout of all administrator sessions and rotate credentials for any accounts that may have visited untrusted pages while authenticated.
Patch Information
At the time of publication, the vendor advisory referenced by Patchstack lists all versions through 2.2 as affected. Verify the WordPress plugin repository for a fixed release before reactivating the plugin.
Workarounds
- Restrict access to /wp-admin/ by IP address using web server or WAF rules to limit CSRF exposure.
- Enforce a strict Content Security Policy that blocks inline scripts and unauthorized external script sources on WordPress pages.
- Require administrators to use a dedicated browser profile for WordPress management to reduce cross-site session reuse.
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate avchat-3
wp plugin delete avchat-3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
