CVE-2024-5200 in Postie Plugin
Summary
by MITRE • 09/29/2025
The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2025
The vulnerability identified as CVE-2024-5200 affects the Postie WordPress plugin version 1.9.71 and earlier, presenting a critical security risk through stored cross-site scripting flaws. This issue specifically targets high-privilege users including administrators who possess the capability to manipulate plugin settings. The vulnerability arises from insufficient sanitization and escaping of user-provided input within the plugin's administrative interfaces, creating persistent XSS attack vectors that can compromise the WordPress environment.
The technical flaw stems from the plugin's failure to properly validate and sanitize data entered through its settings pages. When administrators configure the Postie plugin, they can input various parameters that are subsequently stored in the WordPress database without adequate escaping mechanisms. This allows malicious scripts to be injected and stored within the system, which then execute whenever the affected settings are rendered in the admin interface or displayed to users. The vulnerability is particularly concerning because it operates even when WordPress security measures such as the unfiltered_html capability are restricted, which is a common practice in multisite configurations where security is paramount.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers with administrator privileges to potentially escalate their access within the WordPress environment. Stored XSS attacks can be used to steal session cookies, redirect users to malicious sites, or execute additional attacks against the WordPress installation. In multisite environments where the unfiltered_html capability is typically disabled for security reasons, this vulnerability undermines the intended protection mechanisms and creates a backdoor for persistent attacks. The vulnerability's exploitation requires only administrative access, making it particularly dangerous as it can be leveraged by compromised admin accounts or insider threats.
Mitigation strategies for CVE-2024-5200 involve immediate patching to version 1.9.71 or later, which addresses the sanitization and escaping deficiencies in the plugin's code. Administrators should also implement additional security measures such as regular security audits of installed plugins, monitoring for unauthorized administrative changes, and maintaining up-to-date security policies. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and corresponds to ATT&CK technique T1059.001 for command and scripting interpreter, as attackers can use XSS to execute malicious scripts within the browser context of privileged users. Organizations should also consider implementing web application firewalls and content security policies to provide additional layers of protection against similar vulnerabilities in other WordPress plugins.