CVE-2024-4574

Executive Summary

CVE-2024-4574 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Graphina – Elementor Charts and Graphs WordPress plugin, versions up to and including 1.8.9. The flaw resides in multiple widgets where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is within the WordPress ecosystem and is not related to Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim visits page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access and user interaction, but the potential for widespread impact in a multi-tenant WordPress environment is significant.

Deep Dive & Mechanics

The vulnerability exists because the Graphina plugin fails to properly sanitize and escape user-supplied attributes in its chart and graph widgets. When a contributor creates or edits a page using these widgets, they can inject malicious JavaScript code into attributes such as data-*, class, or custom chart parameters. The plugin outputs these attributes directly into the HTML without encoding, allowing the injected script to be stored in the database and executed when the page is rendered for any user.

The attack flow:

1. Attacker with contributor role logs into WordPress.
2. Creates a new page or edits an existing one using the Graphina Elementor widget.
3. Injects a malicious payload into a widget attribute (e.g., onmouseover="alert('XSS')" or a full <script> tag).
4. Saves/publishes the page.
5. Victim (admin, editor, or visitor) accesses the page.
6. The injected script executes in the victim's browser context.

Vulnerable vs. Patched Code

Vulnerable Code (<=1.8.9): The plugin likely outputs widget attributes directly without escaping. Example (pseudocode):

echo '<div class="graphina-chart" data-options="' . $attributes['data_options'] . '">';

Here, $attributes['data_options'] is not sanitized, allowing injection.

Patched Code (Hypothetical): The fix would involve proper escaping using WordPress functions:

echo '<div class="graphina-chart" data-options="' . esc_attr($attributes['data_options']) . '">';

Additionally, input validation should be applied to ensure only expected values are accepted.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress instance with Graphina plugin <=1.8.9, contributor-level account.
2. Steps:
   • Log in as contributor.
   • Navigate to Pages > Add New.
   • Use Elementor editor to add a Graphina chart widget.
   • In the widget settings, locate an attribute field (e.g., "Chart Title" or custom CSS class).
   • Inject payload: <script>alert(document.cookie)</script> or " onmouseover="alert(1)".
   • Save and publish.
   • Send the page link to the victim.

Example Payload (in attribute):

" onfocus="alert('XSS')" autofocus="true

Blue Team (Detection & Hardening)

• Input Validation: Ensure all user inputs are validated against a whitelist of allowed characters.
• Output Escaping: Use esc_attr(), esc_html(), and wp_kses() appropriately.
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
• User Role Hardening: Restrict contributor capabilities to prevent use of vulnerable widgets if not needed.
• Web Application Firewall (WAF): Deploy rules to block common XSS patterns.

Indicators of Compromise (IOCs)

• File System: Modified plugin files (e.g., wp-content/plugins/graphina-elementor-charts-and-graphs/...).
• Database: Suspicious entries in wp_posts or wp_postmeta containing <script> tags or event handlers.
• Network: Outbound connections from compromised pages to attacker-controlled domains (e.g., for cookie exfiltration).
• Logs: WordPress debug logs showing unexpected attribute values.

Example IOC (Database):

SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%' OR meta_value LIKE '%onmouseover%';

Detection Engineering

YARA Rule

rule CVE_2024_4574_Graphina_XSS {
    meta:
        description = "Detects stored XSS payloads in Graphina plugin attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4574"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4574 Graphina Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS in Graphina plugin attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - '/wp-content/plugins/graphina-elementor-charts-and-graphs/'
        http.body|contains:
            - '<script>'
            - 'onmouseover'
            - 'onfocus'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4574 Graphina Stored XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/graphina-elementor-charts-and-graphs/"; http_uri; pcre:"/(<script[^>]*>|on\w+\s*=\s*["']|javascript\s*:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Graphina plugin until a patch is applied.
2. Short-term: Restrict contributor roles from using Elementor or the Graphina widgets.
3. Long-term: Apply the vendor patch when released. If no patch is available, consider replacing the plugin with an alternative.
4. Hardening: Implement a Web Application Firewall (WAF) with XSS rules. Enable WordPress automatic updates for plugins.
5. Monitoring: Review WordPress logs for suspicious activity and scan for injected scripts.

Valters IT
DevSecOps & Cyber Threat Intelligence