CVE-2024-12739 – Mobile Contact Bar < 3.0.5 – Stored XSS to JS Backdoor Creation – POC

The Mobile Contact Bar plugin for WordPress provides website owners with an intuitive way to create customizable contact options for their visitors. However, a critical Stored Cross-Site Scripting (XSS) vulnerability has been identified in versions below 3.0.5, which can lead to JavaScript backdoor creation and potential full site compromise. This article explores the discovery, exploitation, risks, and mitigation strategies for this vulnerability

CVE	CVE-2024-12739
Plugin	Mobile Contact Bar < 3.0.5
Critical	High
All Time	139 157
Active installations	10 000+
Publicly Published	March 14, 2025
Last Updated	March 14, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12739 https://wpscan.com/vulnerability/5492f1b2-481b-472a-82d3-949f85c8dc70/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

Security researchers identified the vulnerability in the Mobile Contact Bar plugin when analyzing the way user input was processed and stored in the Button List settings. The flaw arises from insufficient input sanitization in the mobile_contact_bar[contacts][1][placeholder] parameter. Attackers can exploit this weakness by injecting malicious JavaScript payloads, leading to persistent execution whenever an admin or user interacts with the infected component.

Understanding of XSS attack’s

Stored XSS occurs when an attacker injects malicious scripts into a web application, which are then permanently stored in the database. When a user loads the affected page, the script executes in their browser, potentially leading to session hijacking, defacement, credential theft, or further exploitation.

Real-World Example in WordPress

A common example in WordPress is a plugin that allows users to input text (e.g., contact forms, comments, or custom buttons) without properly validating and escaping the input. If an attacker inserts JavaScript code into such a field, every subsequent page load by an administrator or visitor will execute the script.

Exploiting the XSS Vulnerability

To exploit the vulnerability in WP Tabs:

POC:

1) Navigate to Settings → Mobile Contact Bar in the WordPress admin panel.
2) Go to the Button List section and fill in the required values.
3) Intercept the request using a web proxy tool such as Burp Suite or Tamper Data.
4) Modify the mobile_contact_bar[contacts][1][placeholder] parameter by inserting the malicious payload
5) Save the settings.
6) When an admin or user hovers over the affected button, the injected script executes, demonstrating successful exploitation.

____

The risks associated with Stored XSS in Mobile Contact Bar include:

• Administrative Account Takeover: If an admin interacts with the infected button, attackers can steal session cookies or inject further malicious scripts.
• JavaScript Backdoor Creation: Attackers can create persistent backdoors that execute malicious JavaScript on every visit.
• Phishing and Social Engineering: Malicious scripts can be used to display fake login prompts, capturing user credentials.
• Defacement and Redirection: Attackers could modify the site’s content, redirect users to malicious sites, or disable security plugins.

Recommendations for Improved Security

To mitigate the risks associated with CVE-2024-12739, administrators should update the Mobile Contact Bar plugin to the latest version as soon as a security patch is available. Additionally, restricting the unfiltered_html capability for non-admin users is essential to prevent unauthorized script injection into the Button list settings.

Proper input sanitization and validation should be enforced for all fields that accept user input, particularly those affecting the frontend, such as the mobile_contact_bar[contacts][1][placeholder] parameter. Implementing Content Security Policies (CSP) can help mitigate the execution of malicious scripts, further strengthening protection against stored XSS attacks.

Regular security audits should be conducted to detect and remediate potential vulnerabilities before they can be exploited. Additionally, limiting user permissions and periodically reviewing user roles can prevent unauthorized modifications to plugin settings.

To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-12739, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.