CVE-2024-54424 Overview
CVE-2024-54424 is a stored Cross-Site Scripting (XSS) vulnerability in the like-on-vkontakte WordPress plugin (Like in Vk.com) developed by ilya_compman. The flaw stems from improper neutralization of input during web page generation [CWE-79] and affects all plugin versions up to and including 0.5.2. An attacker can chain a Cross-Site Request Forgery (CSRF) condition with stored XSS to inject persistent JavaScript payloads that execute in the browser of any user viewing affected pages.
Critical Impact
Successful exploitation allows attackers to execute arbitrary script in administrator browsers, leading to session hijacking, privilege abuse, and persistent site compromise.
Affected Products
- WordPress plugin: Like in Vk.com (like-on-vkontakte)
- All versions from n/a through <= 0.5.2
- Vendor: ilya_compman
Discovery Timeline
- 2024-12-16 - CVE-2024-54424 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54424
Vulnerability Analysis
The vulnerability is a stored XSS issue triggered through a CSRF vector. The plugin fails to sanitize or properly escape user-supplied input before storing it and rendering it in generated web pages. An unauthenticated attacker crafts a malicious request that, when triggered by an authenticated user (typically an administrator), causes the plugin to persist attacker-controlled markup in the WordPress database.
Because the payload is stored, the injected JavaScript executes every time a visitor or administrator loads a page rendering the tainted plugin data. This persistence elevates the impact beyond a transient reflected XSS by enabling sustained client-side compromise across sessions.
Root Cause
The root cause is missing input neutralization in the plugin's request handlers combined with absent CSRF protection (no nonce validation). The plugin accepts settings or content updates without verifying request origin and without escaping HTML-significant characters before storage or output. This dual failure aligns with [CWE-79] and the CSRF-to-stored-XSS chain documented in the Patchstack advisory.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a malicious page or sends a link to a privileged WordPress user. When the victim visits the attacker-controlled resource while authenticated to the target site, the forged request writes a JavaScript payload into plugin storage. The payload then executes for any user rendering the affected page.
Verified exploitation code is not publicly available. See the Patchstack WordPress Plugin Vulnerability advisory for additional technical detail.
Detection Methods for CVE-2024-54424
Indicators of Compromise
- Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in WordPress wp_options or plugin-specific tables related to like-on-vkontakte.
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting external links.
- New or modified administrator accounts and unexplained changes to plugin settings.
Detection Strategies
- Audit plugin settings and database entries for HTML or JavaScript content that should not appear in configuration fields.
- Review web server access logs for POST requests to plugin endpoints originating from external referrers, indicative of CSRF activity.
- Deploy a Web Application Firewall (WAF) rule set to flag stored XSS patterns and missing CSRF tokens on plugin admin actions.
Monitoring Recommendations
- Monitor WordPress administrator sessions for anomalous client-side activity and cookie access from unfamiliar scripts.
- Alert on database writes to plugin tables from non-administrative request paths.
- Track plugin version inventory across WordPress hosts and flag any instance running like-on-vkontakte at version 0.5.2 or earlier.
How to Mitigate CVE-2024-54424
Immediate Actions Required
- Deactivate and remove the like-on-vkontakte plugin until a patched version is published, as no fixed version is currently identified in the advisory.
- Audit all plugin-controlled content and database fields for injected scripts and remove malicious entries.
- Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.
Patch Information
The Patchstack advisory does not list a fixed version at the time of publication. Affected operators should monitor the plugin's repository for an update beyond 0.5.2 and apply it immediately when released. Until then, removal is the recommended path.
Workarounds
- Restrict administrator access to trusted networks and require re-authentication for sensitive actions to limit CSRF exposure.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of injected payloads.
- Deploy a WAF rule that validates request origin headers and blocks HTML or script content submitted to plugin endpoints.
# Example: Disable the vulnerable plugin via WP-CLI
wp plugin deactivate like-on-vkontakte
wp plugin delete like-on-vkontakte
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
