CVE-2024-10181

Executive Summary

CVE-2024-10181 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Newsletters plugin for WordPress, present in all versions up to and including 4.9.9.4. The flaw resides in the newsletters_video shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, potentially leading to session hijacking, credential theft, admin account creation, and full site compromise. The vulnerability carries a CVSS base score of 6.4 (Medium severity), with no known exploits in the wild or inclusion in CISA's Known Exploited Vulnerabilities catalog at the time of writing.

Technical Analysis

The Newsletters plugin for WordPress provides email marketing and newsletter management capabilities. The vulnerability exists within the newsletters_video shortcode, which facilitates embedding video content into newsletter posts and pages. When WordPress parses a post containing this shortcode, it passes user-supplied attributes directly into the rendering process without adequate validation or escaping.

WordPress shortcodes follow the pattern [shortcode_name attr1="value1" attr2="value2"]. Registering a shortcode handler pulls attributes from post content via the shortcode_atts() function, which merges user input with default values. The newsletters_video shortcode takes attributes that control the embedded video's source URL, dimensions, and related display parameters. The vulnerability arises because the handler does not apply proper esc_html(), esc_attr(), or esc_url() functions to these attributes before rendering them into the final HTML output. Instead, raw attribute values flow directly into HTML tags, allowing injection of event handler attributes or additional HTML elements.

An attacker crafts a malicious payload such as [newsletters_video src="x" onerror="alert(document.cookie)"] or uses an attribute value that breaks out of the attribute context entirely with "><script>malicious_code</script>. Because WordPress renders shortcodes server-side when generating the page HTML, the injected payload is embedded in the served content. The stored nature of the vulnerability means the payload persists in the database until the post is deleted. Every visitor to that page receives the payload in their browser, where it executes under the site's origin.

The attack surface is limited to authenticated users with contributor-level access or above. This includes contributors who can create draft posts, authors who can publish, editors, and administrators. While contributors cannot directly publish content, an attacker with contributor access could submit a crafted post with the malicious shortcode, and if an editor or administrator previews it or an editor later publishes it, the payload activates. Authors can publish immediately, expanding the exposure. WordPress multisite configurations and any site that grants contributor roles to users with reduced trust levels increase the practical reach of this flaw.

The vulnerability is classified under the Stored XSS category, which is among the most impactful web application vulnerabilities because it does not require social engineering beyond publishing the malicious content and does not expire. Attackers can leverage the XSS to perform actions as the victim, including creating new administrator accounts, installing malicious plugins, redirecting users to phishing pages, or exfiltrating session cookies and CSRF tokens.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification

An attacker enumerates WordPress sites to identify installations running the Newsletters plugin. They may use the WPScan API or WordPress user enumeration to confirm the plugin version. If the site exposes plugin version information in page source or headers (e.g., ?plugin=newsletters in the footer or readme files), the attacker confirms version 4.9.9.4 or earlier. Alternatively, fingerprinting can identify the newsletters_video shortcode by scanning for known newsletter features or probing wp-json REST API endpoints for plugin references.

Step 2 — Weaponization and Payload Construction

The attacker creates a payload that escalates privileges and establishes persistence. A typical payload for a contributor-level attacker uses the WordPress REST API to create a new administrator account:

[newsletters_video src="x" onerror="fetch('/wp-json/wp/v2/users',{method:'POST',headers:{'Content-Type':'application/json','X-WP-Nonce':nonce},body:JSON.stringify({username:'backdoor',password:'Str0ngP@ss!',email:'attacker@evil.com',roles:['administrator']})})"]

The payload must first retrieve a valid nonce. An attacker can obtain the nonce through a separate XHR to /wp-admin/admin-ajax.php?action=rest-nonce or by reading it from the page's inline script variables if a logged-in user visits the crafted page. For a proof-of-concept, a simpler payload that steals cookies or forcibly downloads a malicious plugin via the plugin installation API could be used.

Step 3 — Payload Delivery and Execution

The attacker logs into WordPress with contributor credentials, creates a new post in draft status, and injects the malicious shortcode into the post content. WordPress does not filter shortcode content at the editor level, so the malicious attributes pass validation. The attacker submits the post for review. The malicious script executes whenever:

• An editor or administrator previews or reviews the pending draft.
• An editor publishes the draft, making it visible to all site visitors.
• An author-level attacker publishes the post directly without any review step.

When any user with an active session loads the page, the server renders the shortcode with the unsanitized attributes, and the browser parses the onerror event handler or injected <script> tag, executing the JavaScript.

Step 4 — Post-Exploitation Impact

Once the JavaScript executes under the victim's session, the attacker can:

• Exfiltrate document.cookie to a remote server, enabling session hijacking if cookies are not HttpOnly-protected.
• Send forged requests to create a new administrator account, installing persistent backdoor access.
• Inject malicious content into existing posts or modify plugin settings to deface the site.
• Perform server-side request forgery (SSRF) via fetch calls to the WordPress admin-ajax or REST endpoints.
• Phish admin users by overlaying fake login forms on legitimate admin pages.

If the victim has administrator privileges, the attacker gains full control of the WordPress installation, including theme editing (which allows arbitrary PHP execution), plugin installation, and user management. The compromise can cascade to server-level access via upload of a PHP webshell disguised as a theme file.

Impact Assessment

Confidentiality Impact (Low per CVSS): The XSS can leak session tokens of users viewing the affected page, potentially exposing administrative credentials and other sensitive data accessible to those sessions. Combined with session hijacking, an attacker gains unauthorized access to the WordPress admin dashboard.

Integrity Impact (Low per CVSS): Attackers can modify site content, inject malicious scripts into legitimate pages, create rogue admin accounts, and alter plugin settings. Successful exploitation undermines the integrity of the entire WordPress environment and any data processed by it.

Availability Impact (Low per CVSS): Malicious scripts could redirect users to attacker-controlled sites, degrade user experience, or wipe site content. An attacker with admin access could deface the site, delete posts, or uninstall essential plugins, leading to an offline or degraded service.

Affected Systems: All WordPress installations running the Newsletters plugin version 4.9.9.4 and earlier. The plugin is an actively maintained product used for email newsletter management, making it a component of many marketing-critical websites. The authentication requirement limits exposure to organizations that grant contributor or higher roles to non-trusted users, such as multi-author blogs, content marketing teams, and agency-managed sites.

Blast Radius: The stored XSS affects every visitor of pages containing the crafted shortcode. This includes anonymous visitors if the post is published as public, and authenticated users in draft-review workflows. Enterprise environments with multiple WordPress sites sharing a plugin installation multiply the exposure. The vulnerability is medium severity (CVSS 6.4) due to the authentication requirement and low impact subscores, but the real-world blast radius can exceed the CVSS assessment when combined with privilege escalation techniques.

CVSS Vector Reasoning: The base score of 6.4 reflects the need for low-privilege authenticated access (PR:L), low attack complexity (AC:L), and the user-interaction requirement for victims to view the page (UI:R). The scope is changed (S:C) because the injected script operates beyond the context of the caller, but the network vector (AV:N) makes it remotely exploitable from any location after authentication.

Detection Guidance

Sigma Rule

title: WordPress Newsletters Plugin Stored XSS - newsletters_video Shortcode
id: a3c4e3d6-9f2b-4f6a-8e1a-0b5d4a7d9f0c
status: experimental
description: Detects WordPress post/save requests containing the newsletters_video shortcode with suspicious attribute payloads indicative of stored XSS exploitation.
author: Valtersit Security Team
date: 2025/01/15
logsource:
  category: webserver
  product: apache
  detection:
    selection_http:
      cs-method: 'POST'
      cs-uri-query|contains:
        - '/wp-admin/post.php'
        - '/wp-admin/post-new.php'
        - '/wp-json/wp/v2/posts'
      sc-status: 200
      cs-user-agent|contains: 'Mozilla'
    selection_payload:
      cs-uri-query|contains:
        - 'newsletters_video'
      cs-uri-query|contains|any:
        - 'onerror'
        - 'onload'
        - 'onclick'
        - 'onmouseover'
        - 'javascript:'
        - '<script'
        - '&lt;script'
    condition: selection_http and selection_payload
  falsepositives:
    - Legitimate use of the shortcode with unusual but benign attribute values
    - Security scanner or WAF testing activities
  level: high
  tags:
    - attack.t1059
    - attack.t1190
    - cve.2024-10181
    - technique.xss

YARA Rule

rule WordPress_Newsletters_Video_Stored_XSS {
    meta:
        author = "Valtersit Security Team"
        date = "2025-01-15"
        description = "Detects malicious newsletters_video shortcode payloads targeting CVE-2024-10181"
        cve = "CVE-2024-10181"
        severity = "High"
        copyright = "Valtersit Security Team"
    strings:
        $shortcode = "newsletters_video"
        $xss_event = /newsletters_video[^>]{0,500}\s+on[a-z]+\s*=/ nocase
        $xss_scheme = /newsletters_video[^>]{0,500}(javascript\s*:|<\s*script|&#[xX]?[0-9a-fA-F]{2})/ nocase
        $xss_svg = /<svg[^>]*onload\s*=/ nocase
        $xss_html = /newsletters_video[^>]{0,300}><[^>]*script/i
    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x3C21 or uint16(0) in (0x3C68, 0x3C62) and
        any of ($xss_event*) or any of ($xss_scheme*) or any of ($xss_svg*) or any of ($xss_html*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-10181 WordPress Newsletters Plugin Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"newsletters_video"; http.request_body; content:"onerror"; nocase; http.request_body; content:"onload"; nocase; http.request_body; content:"javascript:"; nocase; http.request_body; content:"<script"; nocase; http.uri; content:"wp-admin"; http.uri; content:"post.php"; classtype:web-application-attack; sid:202410181; rev:1; metadata:cve CVE-2024-10181, affected_product Wordpress_Newsletters_Plugin, attack_target Web_Server, deployment Perimeter, tag XSS, tag CVE-2024-10181;)

Elastic Detection

sequence by host.name, user.name with maxspan=15s
  [network where event.type == "http" and
   http.request.method == "POST" and
   (http.request.uri contains "/wp-admin/post.php" or
    http.request.uri contains "/wp-admin/post-new.php") and
   url.path returns request body]
  [process where event.action == "file_create" and
   process.command_line contains "newsletters_video"]
  [network where event.outcome == "success" and
   destination.port == 80 or destination.port == 443 and
   process.description contains ("curl", "wget", "powershell", "Invoke-WebRequest")]

Splunk SPL Query

index=web sourcetype=access_combined
| spath input=cs_uri_query output=params path=params{}
| where cs_method="POST" AND (match(cs_uri_query, "wp-admin/post\.php") OR match(cs_uri_query, "wp-json/wp/v2/posts"))
| rex field=_raw "newsletters_video[^\"]*(?<payload>.*)"
| where match(payload, "onerror|onload|onclick|onmouseover|javascript:|<script|&#[xX]")
| eval indicators=mvfilter(match(value, "onerror|onload|onclick|javascript:|<script"))
| stats count by src_ip, cs_user_agent, cs_uri_query, payload
| sort - count

Wazuh OSSEC Rule

<group name="web, wordpress, xss,">
  <rule id="297003" level="8" frequency="5" timeframe="60">
    <decoded_as>json</decoded_as>
    <field name="url">\.(php|aspx|jsp)</field>
    <match>POST</match>
    <regex>wp-admin/post\.php|wp-json/wp/v2/posts</regex>
    <regex>newsletters_video</regex>
    <regex>onerror|onload|javascript:|&lt;script</regex>
    <description>CVE-2024-10181: Attempted exploitation of WordPress Newsletters plugin Stored XSS</description>
    <mitre>
      <id>T1059</id>
      <id>T1190</id>
    </mitre>
    <group>wordpress, xss, web_application_attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

1) Immediate Mitigations (if patch unavailable)

• Disable the plugin: For organizations that cannot immediately apply a patch, deactivating the Newsletters plugin entirely removes the attack surface. This is the most decisive mitigation but impacts newsletter functionality.
• Restrict contributor access: Limit the number of users with contributor-level roles or higher. Remove contributor roles from non-trusted users. Revoke access for external contractors or temporary staff.
• Implement a Web Application Firewall (WAF): Deploy WAF rules that block requests containing newsletters_video combined with HTML event handler attributes (onerror, onload, onclick) or javascript: URIs in POST bodies to wp-admin/post.php or the REST API endpoints.
• Use a WordPress security plugin: Tools like Wordfence, Sucuri, or iThemes Security can add virtual patching and reputation-based blocking. Wordfence provides firewall rules for known plugin vulnerabilities.
• Content Security Policy (CSP): Add a strict CSP header that blocks inline scripts (script-src 'self' 'nonce-randomvalue') to prevent execution of injected JavaScript even if the payload reaches the browser. This does not fix the vulnerability but reduces impact.

2) Patch/Upgrade Steps

• The plugin vendor has publicly acknowledged the vulnerability and a patched version exists; upgrade to the latest available version of the Newsletters plugin from the official WordPress Plugin Directory. The patched version addresses the newsletters_video shortcode sanitization.
• Before upgrading, verify the integrity of the downloaded plugin file by checking its SHA256 checksum against the vendor's published hash.
• After upgrading, conduct a review of all posts and pages for any leftover malicious shortcodes. The patch prevents new injections but does not automatically clean existing compromised content.
• If the vendor's advisory is not accessible, monitor the WordPress Plugin Directory changelog for release notes referencing security fixes.

3) Long-Term Hardening

• Enforce least privilege: Review WordPress user roles quarterly. Ensure only trusted staff hold contributor or higher roles. Use custom roles with limited capabilities for external content providers.
• Enable HTTP-only and Secure flags on session cookies: Modify wp-config.php to set COOKIE_DOMAIN and use a security plugin to enforce HttpOnly and Secure attributes, reducing the value of stolen session tokens.
• Regular backups: Maintain offsite, encrypted backups of the WordPress database and file system. Test restoration procedures monthly.
• Update all plugins and core: Enable automatic updates for plugins, themes, and WordPress core where feasible. Monitor security advisories for plugin dependencies.
• Monitor for account creation: Alert immediately on new administrator user creation. Use PAM/systems management to correlate admin changes to known change tickets.
• Harden wp-admin: Restrict wp-admin and wp-login.php access via IP allowlisting or two-factor authentication (2FA) for all privileged accounts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-10181
2. WordPress Plugin Directory: https://wordpress.org/plugins/newsletters/
3. Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletters
4. WPScan Vulnerability Database: https://wpscan.com/vulnerability/CVE-2024-10181
5. CISA KEV Catalog (No entry): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

As of the publication date of this report, there are no known active exploitation campaigns or inclusion in CISA's Known Exploited Vulnerabilities catalog for CVE-2024-10181. However, due to the authentication requirement and the increasing sophistication of WordPress botnets, organizations running the Newsletters plugin should prioritize patching within 30 days of patch availability, especially if contributor accounts are shared or provided to non-trusted parties.