CVE-2024-13504 is a stored cross-site scripting (XSS) vulnerability classified under CWE-79, found in the 'Shared Files – Frontend File Upload Form & Secure File Sharing' WordPress plugin developed by anssilaitila. The vulnerability affects all versions up to and including 1.7.42. It arises due to insufficient sanitization and escaping of user-supplied input within dfxp file uploads. Specifically, attackers can upload malicious dfxp files containing arbitrary JavaScript code that is stored on the server and executed in the context of any user who accesses these files. This issue is limited to Apache-based web servers where dfxp files are processed by default, as other environments may not handle these files similarly. The vulnerability requires no authentication or user interaction, making it remotely exploitable by any unauthenticated attacker. The CVSS v3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact includes partial confidentiality and integrity loss due to script execution, but no direct availability impact. No patches or known exploits have been reported yet, but the risk remains significant given the plugin's usage in WordPress sites for secure file sharing and frontend uploads. The vulnerability could be leveraged for session hijacking, credential theft, or delivering further malware payloads via the injected scripts.

The vulnerability poses a significant risk to organizations using the affected WordPress plugin, especially those running Apache web servers. Successful exploitation allows attackers to execute arbitrary JavaScript in the context of users visiting the compromised dfxp files, potentially leading to session hijacking, theft of sensitive information, or unauthorized actions performed on behalf of users. This can undermine user trust, lead to data breaches, and facilitate further attacks such as phishing or malware distribution. Since the vulnerability requires no authentication or user interaction, it can be exploited at scale by automated tools. Organizations relying on this plugin for secure file sharing may face reputational damage and compliance issues if exploited. The scope is limited to sites using this specific plugin and Apache environments, but given WordPress's widespread use, the potential impact is broad. The vulnerability does not directly affect system availability but compromises confidentiality and integrity of user sessions and data.

1. Immediate mitigation involves disabling or restricting dfxp file uploads in the plugin settings if possible, to prevent malicious file submissions. 2. Implement strict input validation and sanitization on the server side for all uploaded files, especially dfxp files, ensuring that any embedded scripts or HTML are neutralized before storage or rendering. 3. Apply output encoding/escaping when displaying content derived from uploaded files to prevent script execution in browsers. 4. Restrict access to uploaded dfxp files via web server configuration (e.g., Apache .htaccess rules) to prevent direct access or force downloads instead of rendering. 5. Monitor web server logs for suspicious upload activity or access patterns indicative of exploitation attempts. 6. Keep the plugin updated and monitor vendor announcements for patches or security updates addressing this vulnerability. 7. Employ Web Application Firewalls (WAFs) with rules to detect and block XSS payloads targeting this plugin. 8. Educate site administrators on secure file upload practices and the risks of allowing unauthenticated uploads. 9. Consider alternative secure file sharing plugins with better security track records if patching is delayed.