CVE-2024-37100

Executive Summary

CVE-2024-37100 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elegant Themes Icons WordPress plugin, developed by Mayur Somani and threeroutes media. The vulnerability affects all versions up to and including 1.3. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into the plugin’s icon rendering functionality. When an administrator or other user views a page containing the maliciously crafted icon, the script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is classified as a WordPress ecosystem issue, as the plugin is designed for use within WordPress sites. The CVSS score of 6.5 (Medium) reflects the need for authenticated access and user interaction, but the impact is amplified by the stored nature of the payload, which can affect multiple users over time.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the WordPress plugin repository or directly from the vendor. No supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level or higher WordPress account.
• User Interaction (UI): Required (R) – The victim must view a page containing the malicious icon.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature can lead to widespread compromise within a WordPress site.

Deep Dive & Mechanics

The vulnerability resides in the elegant-themes-icons plugin, which allows users to insert custom icons via shortcodes or editor buttons. The plugin fails to properly sanitize user-supplied input when generating the HTML output for these icons. Specifically, the name or class parameters passed to the shortcode are not neutralized, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access creates a new post or page.
2. The attacker inserts the Elegant Themes Icons shortcode with a malicious payload in one of the parameters, e.g., [elegant-icon name="<script>alert('XSS')</script>"].
3. The plugin stores the shortcode in the WordPress database without sanitization.
4. When an administrator or other user views the post, the shortcode is rendered, and the injected script executes in their browser.

Root Cause: The plugin uses echo or print to output user-supplied data without applying WordPress’s built-in escaping functions like esc_html() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (version 1.3):

function elegant_icon_shortcode($atts) {
    $atts = shortcode_atts(array('name' => ''), $atts);
    $icon_name = $atts['name'];
    // Direct output without sanitization
    return '<i class="elegant-icon ' . $icon_name . '"></i>';
}
add_shortcode('elegant-icon', 'elegant_icon_shortcode');

Patched Code (hypothetical fix):

function elegant_icon_shortcode($atts) {
    $atts = shortcode_atts(array('name' => ''), $atts);
    $icon_name = sanitize_html_class($atts['name']); // Sanitize to allow only CSS classes
    return '<i class="elegant-icon ' . esc_attr($icon_name) . '"></i>';
}
add_shortcode('elegant-icon', 'elegant_icon_shortcode');

The patched version uses sanitize_html_class() to strip dangerous characters and esc_attr() to escape the output for safe HTML attribute insertion.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the Elegant Themes Icons plugin version 1.3 installed.
• A contributor-level account or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [elegant-icon name="x\" onmouseover=\"alert(1)\""]
   

   This payload triggers XSS when the user hovers over the icon.
4. Publish the post.
5. When an administrator views the post and hovers over the icon, the JavaScript executes.

Alternative Payload (Stored XSS):

[elegant-icon name="<img src=x onerror=alert(document.cookie)>"]

Blue Team (Defensive)

Detection Steps:

1. Monitor WordPress logs for unusual shortcode usage, especially from low-privilege users.
2. Search the WordPress database for posts containing [elegant-icon with suspicious parameters:

   SELECT * FROM wp_posts WHERE post_content LIKE '%[elegant-icon%' AND post_content REGEXP '<|>|script|onerror|onmouseover';
   

3. Use a Web Application Firewall (WAF) to block requests containing <script> or event handlers in shortcode parameters.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/elegant-themes-icons/elegant-themes-icons.php (version 1.3)
• Database: Posts or pages containing shortcodes with HTML/JavaScript payloads, e.g., [elegant-icon name="<script>..."]
• Network: Outbound connections from the WordPress server to attacker-controlled domains (if the payload exfiltrates data).
• Logs: WordPress debug logs showing PHP warnings related to elegant_icon_shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_37100_Elegant_Themes_Icons_XSS {
    meta:
        description = "Detects vulnerable Elegant Themes Icons plugin version 1.3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37100"
    strings:
        $vuln_func = "function elegant_icon_shortcode"
        $unsafe_output = "return '<i class=\"elegant-icon " ascii
        $version = "Version: 1.3" ascii
    condition:
        $vuln_func and $unsafe_output and $version
}

Sigma Rule

title: CVE-2024-37100 - Stored XSS via Elegant Themes Icons
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via the Elegant Themes Icons plugin shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "[elegant-icon"
        http.body|contains|all:
            - "<"
            - ">"
            - "script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37100 - Stored XSS via Elegant Themes Icons"; flow:to_server; content:"[elegant-icon"; http_client_body; pcre:"/<[^>]*script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove all shortcodes containing suspicious parameters from the database.
3. Audit user accounts and revoke contributor-level access for untrusted users.

Long-term Fix:

• The vendor must release a patched version that sanitizes shortcode parameters using sanitize_html_class() and esc_attr().
• Alternatively, replace the plugin with a secure alternative.

Workaround:

• Implement a WAF rule to block requests containing <script> or event handlers in shortcode parameters.
• Use WordPress’s built-in wp_kses() function to strip dangerous HTML from post content.

Valters IT – This report is provided for educational and defensive purposes. Unauthorized exploitation is illegal.