CVE-2024-2000 in Premium Addons Pro Plugin
Summary
by MITRE • 03/13/2024
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Scroll Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-2000 affects the Premium Addons PRO plugin for WordPress, specifically targeting the Multi Scroll Widget functionality. This security flaw represents a classic stored cross-site scripting vulnerability that allows malicious actors to inject persistent malicious scripts into the plugin's user interface. The vulnerability exists in all versions up to and including 2.9.12, making it a widespread concern for WordPress installations that utilize this premium plugin. The issue stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating an exploitable pathway for attackers to manipulate the application's behavior through crafted input data.
The technical exploitation of this vulnerability occurs through the 'navigation_dots' parameter within the Multi Scroll Widget component. When an authenticated attacker with contributor-level privileges or higher submits malicious input through this parameter, the plugin fails to properly sanitize or escape the user-supplied data before storing it in the database. This stored data is then later retrieved and displayed in the user interface without proper security measures, creating a persistent XSS vector. The vulnerability is particularly concerning because it requires only contributor-level access, which is a relatively low privilege level that many WordPress sites allow to trusted users or editors. This means that attackers who can gain access to accounts with these permissions can easily compromise the site's security and potentially escalate their privileges further.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including session hijacking, data theft, and privilege escalation. Since the vulnerability affects the Multi Scroll Widget, which is likely used to create interactive scrolling content on websites, attackers can inject scripts that manipulate the user's browsing experience or redirect them to malicious sites. The stored nature of this vulnerability means that once exploited, the malicious scripts will execute automatically whenever any user accesses pages containing the compromised widget, potentially affecting all visitors to the site. This persistent threat makes the vulnerability particularly dangerous for content management systems where multiple users may have access to the affected plugin's interface.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the Premium Addons PRO plugin where the vulnerability has been patched. The fix typically involves implementing proper input sanitization and output escaping mechanisms for all user-supplied parameters, particularly those that are rendered in the browser context. Security practitioners should also consider implementing additional protective measures such as role-based access controls that limit contributor-level access to plugin configuration interfaces, and monitoring for unusual activity in plugin settings. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and may be categorized under ATT&CK technique T1059.007 for script execution via web shells or malicious scripts. Regular security audits of WordPress plugins and adherence to security best practices including principle of least privilege and regular patch management are essential for preventing such vulnerabilities from being exploited in production environments.