CVE-2024-13383 – HD Quiz < 2.0.0 – Stored XSS to JS Backdoor Creation – POC

In modern web development, security vulnerabilities remain a critical concern, particularly when user-generated content is involved. One such vulnerability, CVE-2024-13383, was identified in the HD Quiz plugin (versions prior to 2.0.0) for WordPress. This vulnerability allows an attacker to inject stored cross-site scripting (XSS) payloads into quizzes, leading to potential exploitation and compromise of user data.

CVE	CVE-2024-13383
Plugin	HD Quiz < 2.0.0
Critical	High
All Time	220 609
Active installations	10 000+
Publicly Published	March 14, 2025
Last Updated	March 14, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13383 https://wpscan.com/vulnerability/85bc905d-c960-4399-a879-2d18a4b03007/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

The CVE-2024-13383 vulnerability was discovered during a security audit of the HD Quiz plugin. The issue was found within the question input fields when adding new quiz questions. Due to insufficient input sanitization and escaping, an attacker can inject JavaScript code that executes whenever an administrator or visitor loads the affected quiz.

Understanding of XSS attack’s

Stored XSS vulnerabilities occur when malicious scripts are permanently stored on a website and executed whenever a user accesses the affected page. Unlike reflected XSS, which requires user interaction through specially crafted URLs, stored XSS can remain persistent, making it a severe security risk.

Exploiting the XSS Vulnerability

To exploit this vulnerability in HD Quiz:

POC:

1) Navigate to the HD Quiz plugin in the WordPress admin panel.
2) Create a new quiz by entering a name and pressing enter.
3) Open the newly created quiz and select Add New Question.
4) Inject the XSS payload in the Enter Question field.
5) Add answers to the quiz and save the changes.
6) Upon reloading the page, the injected script will execute.

____

The risks associated with Stored XSS in Mobile Contact Bar include:

• Administrative Account Takeover: If an admin interacts with the infected button, attackers can steal session cookies or inject further malicious scripts.
• JavaScript Backdoor Creation: Attackers can create persistent backdoors that execute malicious JavaScript on every visit.
• Phishing and Social Engineering: Malicious scripts can be used to display fake login prompts, capturing user credentials.
• Defacement and Redirection: Attackers could modify the site’s content, redirect users to malicious sites, or disable security plugins.

Recommendations for Improved Security

To mitigate the risks associated with CVE-2024-13383, administrators should take the following steps:

• Update the Plugin: Ensure that HD Quiz is updated to the latest version (2.0.0 or newer) as soon as a security patch is released.
• Sanitize and Escape Input: All user input, especially quiz questions and answers, should be sanitized using wp_kses and escaped before output.
• Restrict Permissions: Limit the ability to create quizzes and questions to trusted users by restricting the unfiltered_html capability.
• Implement Content Security Policy (CSP): A properly configured CSP can prevent the execution of unauthorized scripts.
• Regular Security Audits: Conduct periodic security audits to identify and remediate potential vulnerabilities proactively.
• Enable Web Application Firewall (WAF): A WAF can help detect and block malicious XSS attempts before they reach the application.

To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-13383, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.