CVE-2024-51632 Overview
CVE-2024-51632 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sam Hoe SH Slideshow WordPress plugin (sh-slideshow). The flaw affects all plugin versions up to and including 4.3. An attacker can chain the CSRF weakness to inject stored Cross-Site Scripting (XSS) payloads into the affected WordPress site. Successful exploitation requires an authenticated administrator to interact with an attacker-controlled link or page. The underlying weakness is categorized as CWE-352.
Critical Impact
An unauthenticated attacker can trick a logged-in administrator into submitting forged requests that store malicious JavaScript, which then executes in the browser of any visitor or admin viewing affected pages.
Affected Products
- Sam Hoe SH Slideshow plugin for WordPress
- SH Slideshow versions from n/a through 4.3
- WordPress sites running sh-slideshow 4.3 or earlier
Discovery Timeline
- 2024-11-19 - CVE-2024-51632 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-51632
Vulnerability Analysis
The SH Slideshow plugin exposes administrative actions that modify slideshow content without verifying request authenticity. The plugin does not validate anti-CSRF tokens (nonces) on state-changing endpoints. An attacker hosts a crafted page that automatically submits a forged request to the targeted WordPress site. When an authenticated administrator visits the page, the browser sends the request with valid session cookies attached.
The forged request writes attacker-controlled input into slideshow content that is later rendered to other users. Because the stored input is not sanitized or output-encoded, embedded JavaScript executes in the context of the WordPress origin. The combined CSRF-to-stored-XSS chain expands impact from a single targeted admin to every visitor of affected pages.
Root Cause
The root cause is the absence of CSRF protection on plugin endpoints that accept administrator input. WordPress provides wp_nonce_field() and check_admin_referer() primitives, but SH Slideshow does not enforce them on the affected actions. A secondary defect — insufficient output escaping of stored slideshow data — converts the CSRF into persistent XSS.
Attack Vector
The attack is network-based and requires user interaction. An attacker delivers a malicious link through phishing email, social media, comments, or a compromised site. The victim must be an authenticated WordPress administrator with the SH Slideshow plugin installed. Once triggered, the injected script runs whenever the slideshow content is rendered, enabling session theft, administrator account takeover, or pivoting to further malware delivery. Refer to the Patchstack advisory for further technical context.
Detection Methods for CVE-2024-51632
Indicators of Compromise
- Unexpected <script>, onerror, or onload payloads stored in SH Slideshow records within the WordPress database.
- Outbound HTTP requests from visitor browsers to attacker-controlled domains when rendering pages containing the slideshow shortcode.
- WordPress admin sessions originating from unfamiliar IP addresses after a targeted admin clicked an external link.
- New or modified administrator accounts created without corresponding audit-log entries.
Detection Strategies
- Inspect the wp_posts and wp_options tables for SH Slideshow content containing HTML event handlers or javascript: URIs.
- Monitor HTTP POST requests to plugin admin endpoints lacking a valid _wpnonce parameter or referrer header.
- Correlate web access logs against administrator login times to identify CSRF-triggering page loads.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin configuration changes and administrator actions.
- Deploy a Web Application Firewall (WAF) rule to alert on missing nonce parameters on sh-slideshow admin requests.
- Continuously scan rendered front-end pages for unauthorized inline scripts using Content Security Policy (CSP) violation reports.
How to Mitigate CVE-2024-51632
Immediate Actions Required
- Update the SH Slideshow plugin to a version newer than 4.3 once a vendor patch is published.
- Deactivate and remove the sh-slideshow plugin if no fixed release is available for your installation.
- Force a password reset for all WordPress administrator accounts and invalidate active sessions.
- Audit stored slideshow entries for injected scripts and remove malicious content.
Patch Information
No fixed version is identified in the available advisory data for releases beyond 4.3. Monitor the Patchstack advisory and the plugin's WordPress.org page for an official update.
Workarounds
- Restrict administrative access to the WordPress dashboard using IP allowlisting at the web server or WAF layer.
- Enforce a strict Content Security Policy that blocks inline scripts to limit stored XSS execution.
- Require administrators to use a dedicated browser profile for WordPress management to reduce CSRF exposure.
- Disable the plugin on production sites until a patched release is verified.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate sh-slideshow
wp plugin delete sh-slideshow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
