CVE-2024-10145 – Hubbub Lite – Stored XSS to Admin Creation – POC

Hubbub Lite, a popular WordPress plugin for social sharing, allows users to integrate share buttons for major social networks such as Facebook, Twitter (X), Pinterest, and LinkedIn. However, a recently discovered vulnerability (CVE-2024-10145) exposes websites to stored cross-site scripting (XSS) attacks. This flaw could allow malicious actors to inject harmful scripts, leading to account hijacking and unauthorized actions within the site.

CVE	CVE-2024-12308
Plugin	Hubbub Lite < 1.34.4
Critical	High
All Time	1 823 261
Active installations	50 000+
Publicly Published	March 04, 2025
Last Updated	March 04, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://wpscan.com/vulnerability/b9e2381b-3ea0-48fa-bd9c-4181ddf36389/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10145
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

During security testing of the Hubbub Lite plugin (versions prior to 1.34.4), a stored XSS vulnerability was identified. The flaw exists in the way the plugin processes and saves social network names within the “Inline Content” settings. Attackers with administrative or editor-level access can inject malicious JavaScript code, which executes when a user interacts with the affected elements..

Understanding of XSS attack’s

Stored XSS is a type of cross-site scripting attack where a malicious script is permanently stored on the target server, typically in a database or file system. Unlike reflected XSS, which requires user interaction via URLs, stored XSS can impact all users who view the compromised content.

Real-world examples of stored XSS vulnerabilities include:

• Comment fields in blogs: Attackers insert malicious scripts into comment sections, which execute when users view the page.
• Profile customization fields: Social media platforms that allow users to set custom profile names or descriptions without proper sanitization.
• Form inputs in plugins: Contact forms, review sections, and search bars that store unsanitized input.

Hubbub Lite’s vulnerability follows a similar pattern, as it fails to properly sanitize user input in the social network name field, leading to persistent script execution.

Exploiting the XSS Vulnerability

To exploit CVE-2024-12308, an attacker with contributor-level privileges:

POC:

1) Navigate to the Hubbub Lite plugin panel in WordPress.
2) Access the "Inline Content" settings.
3) Select a social network from the available options.
4) Modify the name field of the social network and insert an XSS payload.
5) Save the settings and observe the execution of the script when interacting with the share buttons.

Select a social network from the available options.

____

The flaw exists in the way the plugin processes and saves social network names within the “Inline Content” settings. Attackers with administrative or editor-level access can inject malicious JavaScript code, which executes when a user interacts with the affected elements.

Recommendations for Improved Security

To mitigate the risk posed by CVE-2024-10145, website administrators and developers should implement the following security measures:

1. Update the Hubbub Lite Plugin:
   • Upgrade to version 1.34.4 or later, where the vulnerability has been patched.
2. Content Security Policy (CSP):
   • Restrict the execution of inline scripts using CSP headers.
3. User Role Restrictions:
   • Limit plugin modification privileges to trusted administrators only.
4. Security Plugins:
   • Use security plugins like Wordfence or Sucuri to scan for vulnerabilities and suspicious activities.

To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-10145, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.