CVE-2024-12623 in DICOM Support Plugin
Summary
by MITRE • 03/25/2025
The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/25/2025
The DICOM Support plugin for WordPress presents a critical security vulnerability classified as stored cross-site scripting in versions up to and including 0.10.6. This vulnerability exists within the plugin's 'dcm' shortcode implementation where inadequate input sanitization and output escaping mechanisms fail to properly validate user-supplied attributes. The flaw allows authenticated attackers who possess contributor-level permissions or higher to inject malicious scripts that persist in the WordPress environment. These malicious scripts become active whenever any user accesses pages containing the injected content, creating a persistent threat vector that can affect multiple users within the compromised WordPress installation.
The technical exploitation of this vulnerability stems from the plugin's failure to implement proper security controls around user input processing. When administrators or contributors create posts or pages utilizing the 'dcm' shortcode, they can include malicious attributes that are not properly sanitized before being stored in the database. The lack of output escaping means that when these stored attributes are later rendered in web pages, the embedded scripts execute in the context of other users' browsers. This represents a classic stored XSS vulnerability pattern where malicious input is first stored on the server and then executed in response to subsequent user requests, making it particularly dangerous for widespread impact.
From an operational perspective, this vulnerability creates significant risk for WordPress installations using the DICOM Support plugin, as it allows attackers with relatively low privileges to establish persistent malicious presence within the system. The impact extends beyond simple script execution, as these injected scripts can potentially steal user sessions, redirect traffic, modify page content, or even exfiltrate sensitive data from authenticated users. The vulnerability affects all users who access pages containing the malicious shortcode, making it a systemic risk rather than an isolated incident. Attackers can leverage this to perform reconnaissance, escalate privileges, or establish backdoors within the WordPress environment.
The security implications of this vulnerability align with CWE-79, which specifically addresses cross-site scripting flaws in software applications. This classification emphasizes the need for proper input validation and output escaping mechanisms to prevent malicious code injection. The ATT&CK framework categorizes this as a code injection technique, specifically targeting the web application layer where the vulnerability manifests. Organizations should immediately implement mitigation strategies including plugin updates to versions that address the XSS vulnerability, implementing additional security controls such as content security policies, and conducting thorough security audits of all installed plugins. Additionally, privileged users should be educated about the risks of including untrusted content in WordPress posts and pages, as the vulnerability requires legitimate user access to exploit effectively.
Organizations utilizing WordPress systems should prioritize patching this vulnerability through official plugin updates and consider implementing additional protective measures such as web application firewalls and security monitoring solutions. The vulnerability demonstrates the critical importance of proper input validation and output escaping in web applications, particularly in plugins that handle user-generated content. Regular security assessments and vulnerability scanning of WordPress installations can help identify similar issues across the entire system. Access control measures should be reviewed to ensure that only trusted users have the ability to create content that may be processed by vulnerable plugins, reducing the attack surface for such exploitation vectors.