CVE-2024-56267 Overview
CVE-2024-56267 is a stored Cross-Site Scripting (XSS) vulnerability in the html5maps Interactive UK Map WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all versions of the interactive-uk-map plugin up to and including 3.4.8. The Patchstack advisory links this issue to a Cross-Site Request Forgery (CSRF) chain that enables the stored XSS, meaning an attacker can trick an authenticated administrator into submitting a crafted request that persists malicious script content. Once stored, the payload executes in the browser context of any user who renders the affected page.
Critical Impact
Attackers can persist JavaScript payloads that execute in administrator and visitor browsers, enabling session theft, account takeover, and further compromise of the WordPress site.
Affected Products
- html5maps Interactive UK Map plugin for WordPress
- All versions from n/a through <= 3.4.8
- WordPress sites with the interactive-uk-map plugin installed and active
Discovery Timeline
- 2025-01-02 - CVE-2024-56267 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-56267
Vulnerability Analysis
The vulnerability is a stored XSS issue rooted in [CWE-79], Improper Neutralization of Input During Web Page Generation. The Interactive UK Map plugin fails to sanitize or encode user-supplied input before persisting it and rendering it back in the WordPress admin or front-end context. According to the Patchstack advisory, the stored XSS is reachable through a CSRF vector, so the attack chain combines a forged state-changing request with the underlying output-encoding flaw. Successful exploitation requires user interaction, typically an authenticated administrator clicking an attacker-controlled link while logged in.
The scope is changed because script executing in the WordPress page can act against other components such as the browser's same-origin context for the admin dashboard. Confidentiality, integrity, and availability impacts are limited but real, covering session cookies, admin actions, and content modification.
Root Cause
The plugin stores administrator-supplied configuration data, such as map labels or HTML fields, without applying WordPress sanitization helpers like wp_kses, sanitize_text_field, or esc_html on output. Combined with missing or insufficient CSRF nonce validation on the relevant settings handler, an attacker can forge requests that write attacker-controlled script content into the plugin's persisted options.
Attack Vector
An unauthenticated attacker crafts a malicious page or link containing a forged request targeting the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the attacker's page, the browser submits the request using the administrator's session. The plugin accepts the input and stores it. Any subsequent visitor or administrator viewing the affected page triggers execution of the injected JavaScript in their browser.
No verified exploit code is publicly available. See the Patchstack Vulnerability Advisory for technical details.
Detection Methods for CVE-2024-56267
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in wp_options rows or plugin-specific tables related to interactive-uk-map.
- Outbound requests from administrator browsers to unfamiliar domains shortly after viewing WordPress admin pages.
- New or modified WordPress administrator accounts created without a corresponding audit trail.
- Web server access logs showing POST requests to plugin endpoints originating from off-site Referer headers.
Detection Strategies
- Inspect plugin settings and database entries for HTML or JavaScript content where only plain text or sanitized markup is expected.
- Deploy a web application firewall (WAF) rule set that flags requests containing common XSS payload patterns targeting plugin endpoints.
- Review WordPress audit logs for setting changes to the Interactive UK Map plugin without a matching administrator-initiated session.
Monitoring Recommendations
- Enable detailed access logging on /wp-admin/admin-ajax.php and /wp-admin/options.php and alert on requests with suspicious payloads.
- Monitor browser security telemetry, including Content Security Policy (CSP) violation reports, for blocked inline script execution on WordPress pages.
- Track plugin version inventory across all managed WordPress sites and alert on installations of interactive-uk-map at or below version 3.4.8.
How to Mitigate CVE-2024-56267
Immediate Actions Required
- Deactivate the Interactive UK Map plugin until a vendor-supplied patched version above 3.4.8 is confirmed installed.
- Audit existing plugin configuration for stored HTML or script content and remove any unexpected payloads.
- Force-reset administrator session cookies and rotate credentials for accounts that accessed the WordPress admin while the plugin was active.
Patch Information
At the time of NVD publication, the advisory lists affected versions up to and including 3.4.8. Administrators should consult the Patchstack Vulnerability Advisory for the latest fixed version and update the plugin through the WordPress administrator dashboard.
Workarounds
- Restrict WordPress administrator access to a trusted IP allowlist to reduce CSRF exposure.
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to known origins.
- Require administrators to use a dedicated browser profile or session for WordPress management to limit CSRF attack surface.
- Apply virtual patching via a WAF rule that blocks requests containing script tags or event handlers targeting the plugin's endpoints.
# Example: temporarily deactivate the plugin using WP-CLI
wp plugin deactivate interactive-uk-map
wp plugin status interactive-uk-map
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
