CVE-2024-54421: Floating Video Player CSRF Vulnerability

CVE-2024-54421 Overview

CVE-2024-54421 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sanjay_Negi Floating Video Player plugin for WordPress. The flaw affects all versions of the floating-player plugin up to and including version 1.0. An attacker can chain the CSRF flaw with Stored Cross-Site Scripting (XSS), allowing persistent script injection into the WordPress site when an authenticated administrator visits a malicious page. The vulnerability is categorized under [CWE-352] Cross-Site Request Forgery and requires user interaction to trigger. Successful exploitation enables attackers to inject arbitrary JavaScript that executes in the context of site visitors and administrators.

Critical Impact
A successful CSRF-to-Stored-XSS chain allows unauthenticated attackers to inject persistent JavaScript into WordPress sites running the Floating Video Player plugin, leading to session theft, administrative takeover, and malicious redirects.

Affected Products

Sanjay_Negi Floating Video Player plugin (floating-player)
All versions from n/a through <= 1.0
WordPress sites with the plugin installed and active

Discovery Timeline

2024-12-16 - CVE-2024-54421 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54421

Vulnerability Analysis

The vulnerability combines two weaknesses into a single exploit chain. The plugin's administrative settings endpoint lacks anti-CSRF token validation, so state-changing requests are accepted without verifying their origin. The same endpoint also fails to sanitize input fields before persisting them to the WordPress database. An attacker hosts a crafted page that submits a forged POST request to the plugin's settings handler. When a logged-in administrator visits the page, the browser sends authenticated cookies, and the plugin processes the request as legitimate. The injected payload is stored and rendered later in pages served to other users, producing persistent XSS execution.

Root Cause

The root cause is the absence of a WordPress nonce check (wp_verify_nonce or check_admin_referer) on the plugin's settings save handler, combined with missing output escaping when stored values are rendered. Without nonce validation, the plugin cannot distinguish between intentional administrator submissions and forged cross-origin requests.

Attack Vector

The attack requires an authenticated administrator to visit an attacker-controlled URL while logged into WordPress. The malicious page auto-submits a hidden form containing JavaScript payloads to the plugin's settings endpoint. Once stored, the payload executes whenever the affected plugin output is rendered. See the Patchstack Vulnerability Report for further technical detail.

Detection Methods for CVE-2024-54421

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in Floating Video Player plugin settings within wp_options.
Outbound requests from site visitors to unknown domains originating from pages where the floating player is embedded.
Administrative settings changes to the floating-player plugin without corresponding entries in admin activity logs.

Detection Strategies

Audit the WordPress wp_options table for entries related to floating-player and inspect stored values for HTML or JavaScript content.
Monitor HTTP POST requests to wp-admin/admin.php or options.php carrying floating-player parameters that lack a valid _wpnonce value.
Review web server access logs for cross-origin referrers preceding plugin configuration changes.

Monitoring Recommendations

Enable a Web Application Firewall with rules that flag missing or invalid CSRF tokens on WordPress admin endpoints.
Deploy Content Security Policy (CSP) headers to restrict inline script execution and surface XSS attempts in browser reports.
Implement file integrity monitoring on plugin directories under wp-content/plugins/floating-player/.

How to Mitigate CVE-2024-54421

Immediate Actions Required

Deactivate and remove the Floating Video Player plugin until a patched version is released by the vendor.
Review all plugin settings and remove any unexpected script content stored in the database.
Force a password reset and session invalidation for all WordPress administrator accounts.

Patch Information

At the time of publication, no patched version has been identified for the Floating Video Player plugin. The vulnerability affects all versions through 1.0. Site administrators should consult the Patchstack Vulnerability Report for updates on vendor remediation.

Workarounds

Remove the floating-player plugin directory from wp-content/plugins/ to eliminate exposure.
Restrict administrative access to WordPress using IP allowlisting on /wp-admin/ paths.
Require administrators to use separate browser profiles or sessions when managing WordPress to reduce CSRF exposure.
Deploy a virtual patching rule at the WAF layer to block POST requests to the plugin's settings handler when no valid WordPress nonce is present.

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate floating-player
wp plugin delete floating-player