CVE-2024-2237 in Premium Addons Pro Plugin
Summary
by MITRE • 03/13/2024
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-2237 affects the Premium Addons PRO plugin for WordPress, specifically within the Global Badge module. This represents a critical security flaw that allows authenticated attackers with contributor-level privileges or higher to execute stored cross-site scripting attacks. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating a persistent vector for malicious code injection that can affect all users who access compromised pages. The issue impacts all versions of the plugin up to and including version 2.9.12, making it a widespread concern for WordPress installations utilizing this particular plugin.
The technical exploitation of this vulnerability occurs through the Global Badge module's failure to properly sanitize user input before storing and subsequently rendering it on web pages. When an authenticated user with contributor permissions creates or modifies content through this module, malicious scripts can be embedded in the input fields without proper validation or escaping. These scripts become permanently stored within the plugin's data structures and execute whenever any user accesses pages containing the injected content, regardless of their permission level or authentication status. This stored nature of the XSS vulnerability makes it particularly dangerous as the malicious code persists and can affect multiple users over time without requiring repeated exploitation attempts.
From an operational standpoint, this vulnerability creates significant risk for WordPress administrators and end-users alike. Attackers with contributor-level access can leverage this flaw to inject malicious scripts that could steal user sessions, redirect visitors to malicious sites, deface websites, or harvest sensitive information from authenticated users. The impact extends beyond simple script execution as the stored nature of the vulnerability means that compromised pages can serve as persistent attack vectors that continue to affect users long after the initial injection occurs. This vulnerability essentially transforms the compromised plugin into a platform for ongoing attacks against the website's user base and can potentially serve as a foothold for more extensive compromise of the WordPress installation or underlying server infrastructure.
The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in software applications, and represents a classic case of insufficient output escaping that allows malicious input to be rendered as executable code. From an ATT&CK framework perspective, this vulnerability maps to techniques involving web application exploitation and persistent threat vectors, potentially enabling adversaries to establish long-term access through the compromised plugin. Organizations should implement immediate mitigations including updating to the latest version of the Premium Addons PRO plugin where the vulnerability has been addressed, implementing proper input validation measures, and monitoring for suspicious activity in contributor accounts. Additionally, administrators should consider implementing role-based access controls to limit the permissions of users with contributor-level access and conduct regular security audits of installed plugins to identify potential vulnerabilities before they can be exploited by threat actors.