CVE-2024-51781: Firework Shoppable Live Video XSS Flaw

CVE-2024-51781 Overview

CVE-2024-51781 is a reflected cross-site scripting (XSS) vulnerability in the Stefan Backor Firework Shoppable Live Video WordPress plugin (firework-videos). The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All plugin versions up to and including 6.3 are affected. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser session under the context of the vulnerable WordPress site.

Critical Impact
Successful exploitation enables session hijacking, credential theft, defacement, and redirection to attacker-controlled infrastructure through reflected script execution in the victim's browser.

Affected Products

Stefan Backor Firework Shoppable Live Video (firework-videos) plugin for WordPress
All versions from initial release through 6.3
WordPress sites with the plugin installed and accessible to visitors

Discovery Timeline

2024-11-09 - CVE-2024-51781 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51781

Vulnerability Analysis

The Firework Shoppable Live Video plugin fails to sanitize or encode user-supplied input before reflecting it back in HTTP responses. This permits an attacker to inject HTML and JavaScript payloads into the generated page. Because the issue is reflected, the payload must be delivered to the victim through a crafted link or a third-party page that triggers the request.

The attack requires user interaction, typically clicking a malicious link. The injected script runs in the browser's same-origin context for the vulnerable WordPress site. This grants the attacker access to cookies, session tokens, and the Document Object Model (DOM) of the affected page. Because the vulnerability allows scope change, the impact can cross security boundaries within the browser.

Root Cause

The plugin's request handlers echo parameter values into HTML output without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). Missing contextual output encoding allows raw HTML and <script> tags to be rendered by the browser. This is a classic instance of [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker constructs a URL containing a JavaScript payload in a vulnerable request parameter handled by the plugin. The attacker then distributes the link through phishing email, social media, or malicious advertising. When a victim follows the link, the server reflects the payload into the response, and the browser executes the script. No authentication is required to craft the payload, but the victim must interact with the malicious URL. Refer to the Patchstack Vulnerability Report for the disclosed parameter details.

Detection Methods for CVE-2024-51781

Indicators of Compromise

HTTP requests to firework-videos plugin endpoints containing URL-encoded <script>, javascript:, or onerror= sequences in query parameters
Web server access logs showing unusually long query strings or repeated requests from the same source with HTML control characters
Browser console errors or unexpected outbound requests from pages rendering Firework plugin content
WordPress administrators reporting unexpected pop-ups, redirects, or session terminations after clicking shared links

Detection Strategies

Inspect web application firewall (WAF) logs for OWASP CRS rules matching XSS patterns targeting /wp-content/plugins/firework-videos/ paths
Search HTTP referrer fields for external domains delivering crafted links to Firework plugin URLs
Correlate authentication anomalies, such as session reuse from new IPs, with prior visits to plugin endpoints

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and forward logs to a central SIEM for query-parameter analysis
Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script execution attempts
Monitor the WordPress plugin update channel for patched releases of firework-videos and alert on installed versions ≤ 6.3

How to Mitigate CVE-2024-51781

Immediate Actions Required

Inventory all WordPress installations and identify sites running the firework-videos plugin at version 6.3 or earlier
Deactivate the plugin on affected sites until a vendor-supplied patch is installed
Force password rotation and session invalidation for administrators who may have clicked suspicious links
Review the Patchstack advisory for the latest remediation guidance

Patch Information

At the time of publication, no fixed version was identified in the NVD record beyond 6.3. Site operators should monitor the Patchstack advisory and the official WordPress plugin repository for an updated release that introduces proper output encoding.

Workarounds

Deploy a WAF rule blocking requests to firework-videos endpoints containing <, >, script, or javascript: substrings in query parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted domains
Restrict access to the plugin's public endpoints by IP allow-listing where business requirements permit
Educate administrators and editors to avoid clicking unverified links referencing the WordPress site

bash

# Example WAF rule (ModSecurity) blocking common XSS payloads on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/firework-videos/" \
  "id:1005178,phase:2,deny,status:403,log,msg:'Block XSS attempt against firework-videos plugin',\
   chain"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "t:none,t:urlDecodeUni,t:lowercase"